Cyber Resilience

CVE-2026-1978

Medium

Published: 06 February 2026

Published
06 February 2026
Modified
27 February 2026
KEV Added
Patch
CVSS Score v4 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0005 17.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1978 is a medium-severity Forced Browsing (CWE-425) vulnerability in Kalyan02 Nanocms. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-1978 is a vulnerability in kalyan02 NanoCMS versions up to 0.4, published on 2026-02-06. It affects an unknown functionality within the /data/pagesdata.txt file of the User Information Handler component, enabling direct request manipulation.

The vulnerability is remotely exploitable by unauthenticated attackers requiring low attack complexity and no user interaction. Exploitation allows limited disclosure of confidential information, with no impact on integrity or availability, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). It maps to CWE-425 (Direct Request).

Advisories recommend changing configuration settings to mitigate the issue. The exploit is publicly available, with references including the NanoCMS GitHub repository at https://github.com/kalyan02/NanoCMS/ and the vulnerable file at https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt, along with VulDB entries at https://vuldb.com/?ctiid.344500, https://vuldb.com/?id.344500, and https://vuldb.com/?submit.743260.

EU & UK References

Vulnerability details

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate…

more

the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct request manipulation in public-facing NanoCMS enables unauthenticated remote file access for local data collection (T1005) via exploitation of the web application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2022-50898Same product: Kalyan02 Nanocms
CVE-2025-26689Shared CWE-425
CVE-2026-22732Shared CWE-425
CVE-2026-4532Shared CWE-425
CVE-2026-0790Shared CWE-425
CVE-2025-2147Shared CWE-425
CVE-2026-34056Shared CWE-425
CVE-2026-25679Shared CWE-425
CVE-2026-32867Shared CWE-425
CVE-2025-52024Shared CWE-425

Affected Assets

kalyan02
nanocms
≤ 0.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces access control policies on resources such as /data/pagesdata.txt, blocking the unauthenticated direct-request access that enables the information disclosure.

prevent

Restricts processes and users to the minimum necessary privileges, preventing exposure of the sensitive pagesdata.txt file to remote unauthenticated requests.

prevent

Requires secure configuration settings for the User Information Handler component, directly addressing the advisory recommendation to change settings that currently permit direct file requests.

References