CVE-2026-65612
Received Received - Intake

Path Traversal in nnn File Manager

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: CERT.PL

Description
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-65612
EUVD
EUVD-2026-62401

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in nnn involves improper sanitization of filenames. An attacker can create a file with a specially crafted name containing a single quote followed by shell commands. When a victim opens this file using preview-tabbed, the filename is inserted into a shell command, allowing the attacker's payload to execute with the same privileges as the nnn process.

Detection Guidance

This vulnerability involves crafted filenames with shell syntax that execute when opened with nnn's preview-tabbed feature. To detect it, inspect filenames in shared filesystems, removable media, or archives for single quotes followed by shell commands. Check if nnn is installed and review its version (5.2 is confirmed vulnerable).

Commands to check: 'which nnn', 'nnn --version', and 'find / -type f -name "*'*"' -o -name "*\`*"' 2>/dev/null' to locate suspicious filenames.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary commands on your system if you open a maliciously named file with nnn's preview-tabbed feature. The impact depends on the privileges of the nnn process, potentially leading to unauthorized access or control of your system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized code execution through crafted filenames. If exploited, it may lead to data breaches or unauthorized access, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Immediately update nnn to the latest version if available. Avoid using preview-tabbed with untrusted files. Disable or restrict nnn's access to shared filesystems and removable media. Monitor for unusual shell activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart