PT-2026-7618 · Unknown · Minigal Nano

Philopentest · Published 2026-02-11 · Updated 2026-02-11 · CVE-2026-25869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MiniGal Nano versions 0.3.5 and prior

Description The application has a flaw where user-provided input, specifically through the dir parameter in 'index.php', can be manipulated to access files outside the intended directory. The application attempts to prevent this by removing 'dot-dot' sequences, but this protection can be bypassed with specific directory patterns. Successful exploitation allows an attacker to list and view image files from unexpected locations on the system that the web server can read, leading to information disclosure.

Recommendations Versions prior to 0.3.5 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-25869

Affected Products

Minigal Nano

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25869 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25869 · Vendor Advisory
• https://web.archive.org/web/20180330004313/http://minigal.dk/minigal-nano.html · Note
• https://vulncheck.com/advisories/minigal-nano-path-traversal-via-dir-parameter · Note
• https://sourceforge.net/projects/minigalnano · Note
• https://twitter.com/CVEnew/status/2021655552959349099 · Twitter Post