PT-2026-7618 · Unknown · Minigal Nano

Philopentest · Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2026-25869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MiniGal Nano versions 0.3.5 and prior

Description The application has a flaw where user-provided input, specifically through the dir parameter in 'index.php', can be manipulated to access files outside the intended directory. The application attempts to prevent this by removing 'dot-dot' sequences, but this protection can be bypassed with specific directory patterns. Successful exploitation allows an attacker to list and view image files from unexpected locations on the system that the web server can read, leading to information disclosure.

Recommendations Versions prior to 0.3.5 should be updated.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-25869

Produtos afetados

Minigal Nano

Referências · 6

• https://web.archive.org/web/20180330004313/http://minigal.dk/minigal-nano.html · Nota
• https://vulncheck.com/advisories/minigal-nano-path-traversal-via-dir-parameter · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25869 · Nota de Segurança
• https://sourceforge.net/projects/minigalnano · Nota
• https://twitter.com/CVEnew/status/2021655552959349099 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25869 · Aviso do Fabricante