Local File Overwrite Vulnerability in Nullsoft Scriptable Install System
CVE-2015-9267

5.5MEDIUM

Key Information:

Vendor: Nullsoft
Status: Nullsoft Scriptable Install System
Vendor: CVE Published:; 1 October 2018

What is CVE-2015-9267?

The Nullsoft Scriptable Install System (NSIS) prior to version 2.49 is susceptible to a local file overwrite vulnerability. This issue arises due to insecure handling of temporary folder locations, enabling unprivileged local users to overwrite critical files. An attacker can replace legitimate plugins or the uninstaller with a malicious program, potentially leading to system compromise and exploitation through a Trojan horse. It is crucial for users to update their NSIS installations to mitigate this risk.