CVE-2026-1978 PUBLISHED

kalyan02 NanoCMS User Information pagesdata.txt direct request

Assigner: VulDB
Reserved: 05.02.2026 Published: 06.02.2026 Updated: 06.02.2026

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 6.9

Product Status

Vendor kalyan02
Product NanoCMS
Versions
  • Version 0.1 is affected
  • Version 0.2 is affected
  • Version 0.3 is affected
  • Version 0.4 is affected

Credits

  • g111 (VulDB User) reporter

References

Problem Types

  • Direct Request CWE