CVE-2026-1978

Medium

Published: 06 February 2026

Published

06 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score 0.0004 13.5th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1978 is a medium-severity Forced Browsing (CWE-425) vulnerability in Kalyan02 Nanocms. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-24 Access Control Decisions

addresses: CWE-425

Forcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths.

AC-25 Reference Monitor

addresses: CWE-425

Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks.

AC-3 Access Enforcement

addresses: CWE-425

Enforcing access for all logical requests prevents unauthorized direct access to protected resources.

AC-8 System Use Notification

addresses: CWE-425

Displaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent.

SC-26 Decoys

addresses: CWE-425

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

SI-9 Information Input Restrictions

addresses: CWE-425

Blocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct request manipulation in public-facing NanoCMS enables unauthenticated remote file access for local data collection (T1005) via exploitation of the web application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate…

the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

Deeper analysisAI

CVE-2026-1978 is a vulnerability in kalyan02 NanoCMS versions up to 0.4, published on 2026-02-06. It affects an unknown functionality within the /data/pagesdata.txt file of the User Information Handler component, enabling direct request manipulation.

The vulnerability is remotely exploitable by unauthenticated attackers requiring low attack complexity and no user interaction. Exploitation allows limited disclosure of confidential information, with no impact on integrity or availability, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). It maps to CWE-425 (Direct Request).

Advisories recommend changing configuration settings to mitigate the issue. The exploit is publicly available, with references including the NanoCMS GitHub repository at https://github.com/kalyan02/NanoCMS/ and the vulnerable file at https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt, along with VulDB entries at https://vuldb.com/?ctiid.344500, https://vuldb.com/?id.344500, and https://vuldb.com/?submit.743260.