CVE-2026-121549
Last modified
CVE-2026-121549 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write..
Description
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jarun | nnn | <= 5.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-121549?
How severe is CVE-2026-121549?
How do I fix CVE-2026-121549?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121543smart-sso through 2.0.1 contains an incorrect authorization …8.8
- CVE-2026-121544Koodo Reader through 2.4.6 contains a path traversal vulnera…4.9
- CVE-2026-121545Dreeve before 5.8.0 contains a missing authentication vulner…6.5
- CVE-2026-121546ruTorrent before 5.3.20 contains a path traversal vulnerabil…5.9
- CVE-2026-121547Canop dysk before 3.8.2 contains a terminal escape sequence …2.2
- CVE-2026-121548Jarun nnn through 5.3 contains an OS command injection vulne…7.8
- CVE-2026-12155IBM MQ could allow an authenticated attacker to cause a deni…6.5
- CVE-2026-121550nnn through 5.3 contains an insecure file handling vulnerabi…3.3
- CVE-2026-121551PostfixAdmin through 4.0.5 contains a stored cross-site scri…5.4
- CVE-2026-121552Dromara domain-admin before 1.6.79 contains a missing author…4.3
- CVE-2026-121553Cotonti through 1.0.0 generates registration and email-chang…4.8
- CVE-2026-121554cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an…5.9
Are you affected by CVE-2026-121549?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST