CVE-2026-121549: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

Published Nov 3, 2026

Updated

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users who run the pdfread or nuke plugins on a system where another local user can create entries in /tmp are exposed. The attacker can target files that the plugin-running user has permission to write.

What does an attacker need to exploit it?

The attacker needs local access and must create a symbolic link at a predictable temporary-file path derived from a name or process ID before the victim runs the affected plugin. Victim interaction is required because the victim must invoke the plugin.

Are all nnn installations affected by default?

The issue is described specifically in the pdfread and nuke plugins, so exposure depends on whether those plugins are used. The provided data does not establish that every default installation invokes or includes them.

What can be done until a fix is applied?

Avoid running the affected pdfread and nuke plugins in environments with untrusted local users who can manipulate /tmp. Restricting access to the affected system and preventing untrusted users from creating the predicted symlinks reduces exposure.

How can administrators determine whether they may be affected?

Check whether nnn through version 5.3 is in use and whether the pdfread or nuke plugins are executed. Review /tmp for suspicious symlinks at plugin temporary-file names derived from file names or process IDs.

CVE-2026-121549: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are all nnn installations affected by default?

What can be done until a fix is applied?

How can administrators determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are all nnn installations affected by default?

What can be done until a fix is applied?

How can administrators determine whether they may be affected?