CVE-2026-1978
Remote Manipulation Vulnerability in kalyan02 NanoCMS User Handler
Publication date: 2026-02-06
Last updated on: 2026-02-27
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kalyan02 | nanocms | to 0.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-425 | The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves changing the configuration settings of NanoCMS to enforce proper authorization controls on the /data/pagesdata.txt file.
This will prevent unauthorized remote access to sensitive user information stored in that file.
Can you explain this vulnerability to me?
CVE-2026-1978 is a vulnerability in kalyan02 NanoCMS versions up to 0.4 that affects the User Information Handler component via the file /data/pagesdata.txt.
The issue is a direct request vulnerability where the web application fails to enforce proper authorization on this file, allowing remote attackers to directly access sensitive user information without authentication.
This happens because the CMS does not properly restrict access to the pagesdata.txt file, which stores user data, enabling attackers to retrieve sensitive administrator user information by sending direct web requests.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive user information, including administrator data, compromising confidentiality.
Attackers can remotely exploit this flaw without any authentication, making it easy to access sensitive data.
Such exposure can result in privacy breaches, potential identity theft, or further attacks leveraging the leaked information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the file /data/pagesdata.txt is accessible without authentication on the target NanoCMS installation.'}, {'type': 'paragraph', 'content': 'One way to detect it is by attempting to directly request the file via HTTP, for example using curl or wget commands.'}, {'type': 'list_item', 'content': 'curl -I http://target-website.com/data/pagesdata.txt'}, {'type': 'list_item', 'content': 'wget --spider http://target-website.com/data/pagesdata.txt'}, {'type': 'paragraph', 'content': "Additionally, Google dorking can be used to find vulnerable targets by searching for URLs containing 'inurl:data/pagesdata.txt'."}, {'type': 'list_item', 'content': 'Google search query: inurl:data/pagesdata.txt'}] [3, 2]