Information Disclosure Vulnerability in Nging by Admpub

CVE-2026-119653

What is CVE-2026-119653?

The Nging application, specifically version 5.3.5, contains a vulnerability that permits authenticated backend users to exploit the /user/autocomplete_path endpoint. This flaw allows low-privileged users—who do not have file-manager permissions—to input arbitrary paths into the query parameter. As a result, they can enumerate directories accessible by the Nging process, leading them to confirm the existence of specific files. This poses a significant risk as sensitive information could potentially be exposed.

References