Threats tagged 'ghsa-jcvf-cf9r-682f'

Nging through 5.3.5 has an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the /user/autocomplete_path endpoint. Low-privileged users without file-manager permissions can supply arbitrary paths to enumerate directories readable by the Nging process and confirm the existence of specific files.