CVE-2026-1978
Published: 06 February 2026
Summary
CVE-2026-1978 is a medium-severity Forced Browsing (CWE-425) vulnerability in Kalyan02 Nanocms. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-1978 is a vulnerability in kalyan02 NanoCMS versions up to 0.4, published on 2026-02-06. It affects an unknown functionality within the /data/pagesdata.txt file of the User Information Handler component, enabling direct request manipulation.
The vulnerability is remotely exploitable by unauthenticated attackers requiring low attack complexity and no user interaction. Exploitation allows limited disclosure of confidential information, with no impact on integrity or availability, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). It maps to CWE-425 (Direct Request).
Advisories recommend changing configuration settings to mitigate the issue. The exploit is publicly available, with references including the NanoCMS GitHub repository at https://github.com/kalyan02/NanoCMS/ and the vulnerable file at https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt, along with VulDB entries at https://vuldb.com/?ctiid.344500, https://vuldb.com/?id.344500, and https://vuldb.com/?submit.743260.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5600
Vulnerability details
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate…
more
the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct request manipulation in public-facing NanoCMS enables unauthenticated remote file access for local data collection (T1005) via exploitation of the web application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access control policies on resources such as /data/pagesdata.txt, blocking the unauthenticated direct-request access that enables the information disclosure.
Restricts processes and users to the minimum necessary privileges, preventing exposure of the sensitive pagesdata.txt file to remote unauthenticated requests.
Requires secure configuration settings for the User Information Handler component, directly addressing the advisory recommendation to change settings that currently permit direct file requests.