CVE-2026-1978CWE-425

kalyan02 NanoCMS User Information pagesdata.txt direct request

Medium · published February 6, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2026-02-06T04:02Z
EPSS history
Timeline
  • 06 FEB 04:02Z
    kalyan02 NanoCMS User Information pagesdata.txt direct request
    cvelistv5