CVE-2026-119653 Details

A directory listing disclosure vulnerability has been identified in Nging versions through 5.3.5. This issue allows any authenticated backend user to enumerate host directories by exploiting the publicly accessible '/user/autocomplete_path' endpoint. Low-privileged users, lacking file-manager permissions, can input arbitrary paths to list directories readable by the Nging process and verify the existence of specific files.

The vulnerability can be addressed by changing the endpoint's permission level to require file-manager or server-management rights, and by confining the search to a designated base directory using the Go 'os.OpenRoot' sandbox. Additionally, the endpoint should be updated to reject absolute paths and paths containing '..' to prevent unauthorized access to sensitive filesystem areas.