CVE-2026-1978

5.5 mediumEPSS 0.4%

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-425
Published: 2026-02-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kalyan02:nanocms

References

https://github.com/kalyan02/NanoCMS/
https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt
https://vuldb.com/?ctiid.344500
https://vuldb.com/?id.344500
https://vuldb.com/?submit.743260

Check your stack JSON