CVE-2026-121549— nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

Quick assessment

Affected

jarun nnn

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

nnn 5.3 及更早版本在 pdfread 和 nuke 插件中存在不安全的临时文件漏洞。该漏洞允许本地攻击者利用 /tmp 目录中可预测的路径来覆盖文件。攻击者可预先在基于文件名或进程 ID（PID）生成的路径上创建符号链接，从而使受害者的插件在运行时截断并覆盖受害者有权写入的任何文件。

CVSS 4.4 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1558.004 · AS-REP Roasting

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

Source: CVE Program / CVE List V5

Vulnerability Description

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

不安全的临时文件

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jarun	nnn	0 ~ 5.3	-

II. Public POCs for CVE-2026-121549

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121549

请登录查看更多情报信息。

Other References for CVE-2026-121549 (6)

https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10 technical-description
https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280 technical-description
https://github.com/jarun/nnn product
https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff patch
https://github.com/jarun/nnn/issues/2188 issue-tracking
https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121549

Same Patch Batch · jarun · 2026-11-03 · 4 CVEs total

CVE-2026-121548	7.8 HIGH	nnn through 5.3 OS Command Injection via togglex Plugin
CVE-2026-121627	6.1 MEDIUM	buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
CVE-2026-121550	3.3 LOW	nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling

IV. Related Vulnerabilities

Same product: nnn

Same vendor: jarun

Same weakness: CWE-377