UBUNTU-CVE-2026-121549: Medium severity ubuntu/nnn vulnerability

Published Nov 3, 2026

Updated

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

Affected Software

6 affected components

ubuntu/nnn*

Event History

Nov 3, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users who run the pdfread or nuke plugins in nnn through version 5.3 are exposed if a local attacker can prepare a matching symbolic link in /tmp. The attacker can cause overwrite of files that the plugin-running user is permitted to write.

What does an attacker need to exploit it?

The attacker needs local access and must pre-create a symlink at a predictable temporary-file path derived from a name or process ID. Exploitation also requires the victim to run the affected plugin.

Are all nnn uses affected by default?

The issue is described specifically in the pdfread and nuke plugins. The provided information does not indicate that nnn is affected when those plugins are not used.

How can I determine whether a system may be affected?

Check whether the installed nnn version is 5.3 or earlier and whether users run the pdfread or nuke plugins. Systems where untrusted local users can create files or symlinks in /tmp present the relevant attack condition.

UBUNTU-CVE-2026-121549: Medium severity ubuntu/nnn vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are all nnn uses affected by default?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are all nnn uses affected by default?

How can I determine whether a system may be affected?