TI-2026-83127 CVE-2026-119653 · GHSA-jcvf-cf9r-682f
Missing authorization in Nging exposes host directory listings
Priority LOW 24
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint.