CVE-2026-121549
Description
A flaw was found in nnn. The pdfread and nuke plugins create temporary files in shared directories using predictable file paths. A local attacker can exploit this flaw by pre-creating a symbolic link at the intended location, causing the application to truncate and overwrite arbitrary files writable by the user running the plugin.
Statement
An insecure temporary file vulnerability was found in nnn's pdfread and nuke plugins, which create temporary files at predictable name- or PID-derived paths in shared directories such as /tmp. A local attacker who can pre-create a symbolic link at such a path can cause the victim's plugin run to truncate and overwrite any file the victim can write. nnn through 5.3 is affected; the fix (upstream commits 0471592/bb2e85e) is not yet in a tagged release.
Mitigation
Update to a tagged nnn release containing the fix once available. Until then, avoid the pdfread and nuke plugins, or run nnn with TMPDIR set to a private directory (e.g., via mktemp -d) so the predictable paths cannot be pre-created by other local users.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
