Filtered by vendor Gnu Subscriptions
Filtered by product Nano Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-25869 3 Gnu, Minigal, Rybber 3 Nano, Minigal, Minigal Nano 2026-03-05 7.5 High
MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit this behavior to cause the application to enumerate and display image files from unintended filesystem locations that are readable by the web server, resulting in unintended information disclosure.
CVE-2026-25868 3 Gnu, Minigal, Rybber 3 Nano, Minigal, Minigal Nano 2026-03-05 6.1 Medium
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application.
CVE-2024-5742 2 Gnu, Redhat 2 Nano, Enterprise Linux 2025-11-21 6.7 Medium
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.
CVE-2010-1160 1 Gnu 1 Nano 2025-04-11 N/A
GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.
CVE-2010-1161 1 Gnu 1 Nano 2025-04-11 N/A
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.