SZB-ed4b625df3
EUVD-2026-114069 reports directory listing flaw in Nging backend
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- admpub
- Product
- Nging
- First seen
Summary
The EUVD entry, shared on Mastodon, says Nging through 5.3.5 has an information disclosure flaw that lets any authenticated backend user list host directories via the /user/autocomplete_path endpoint. It assigns a CVSS v3.1 score of 5.3.
If you use admpub
Check the admpub Nging project for a fixed release and upgrade past 5.3.5
Limit backend account creation and review existing users
Restrict or disable the autocomplete_path endpoint until patched
What the sources say 1
· Mastodon: “Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint.” Source