CVE-2026-121549
MEDIUM
NVD
CVSS Score
4.4
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.