Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · admpubNVD modified 2026-10-30 14:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/admpub/nging/issues/831 issue-tracking
- https://github.com/admpub/nging/commit/6434d026f668bdb5d59db658036fd6febbd29c0c patch
- https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/init.go#L28-L42 technical-description
- https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/profile.go#L136-L157 technical-description
- https://hackmd.io/@hieuPenguinnn/nging-user-autocomplete-path-filesystem-disclosure third-party-advisory
- https://github.com/admpub/nging product
- https://www.vulncheck.com/advisories/nging-through-5.3.5-directory-listing-disclosure-via-user-autocomplete-path third-party-advisory