Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119653Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path

Medium 4.3

In plain English

A medium-severity missing authorization in nging from admpub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.

Affected products (as reported)

Vendor	Product	Versions
admpub	nging	0 – through 5.3.5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/admpub/nging/issues/831 issue-tracking
https://github.com/admpub/nging/commit/6434d026f668bdb5d59db658036fd6febbd29c0c patch
https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/init.go#L28-L42 technical-description
https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/profile.go#L136-L157 technical-description
https://hackmd.io/@hieuPenguinnn/nging-user-autocomplete-path-filesystem-disclosure third-party-advisory
https://github.com/admpub/nging product
VulnCheck Advisory: Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path third-party-advisory