CVE-2026-6842
Insecure Directory Permissions in nano Allow Local Code Injection
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the nano text editor when used in environments with permissive umask settings. Specifically, the ~/.local directory is created with overly permissive permissions (0777) instead of more restrictive ones (0700). Because of this, a local attacker can place a malicious .desktop launcher file into this directory. If the launcher is later processed by the system, it could trigger unintended actions or lead to information disclosure.
How can this vulnerability impact me? :
The impact of this vulnerability is limited but notable. A local attacker with access to the affected system can exploit the incorrect directory permissions to inject a malicious .desktop launcher. This could cause unintended actions to be executed or sensitive information to be disclosed if the launcher is processed. However, the overall severity is low, as indicated by the CVSS score of 2.5, and it requires local access and high attack complexity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the permissions of the ~/.local directory on affected systems. Specifically, look for overly permissive permissions set to 0777 instead of the recommended 0700.
- Run the command: ls -ld ~/.local
- If the output shows permissions as drwxrwxrwx (0777), the system is vulnerable.
- Additionally, inspect the ~/.local directory for any suspicious or unexpected .desktop launcher files that could have been injected by an attacker.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately correct the permissions of the ~/.local directory to restrict access.
- Run the command: chmod 700 ~/.local
- Review and remove any suspicious .desktop launcher files within the ~/.local directory.
- Ensure that the system's umask settings are configured to prevent overly permissive directory permissions in the future.