Summary
It was discovered that NNCP did not properly sanitize file paths
in packet data during file requesting and file saving operations. A
remote attacker could possibly use this issue to read or write
arbitrary files outside of the intended directory.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | nncp | 8.11.0-4+deb13u1build0.25.10.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | nncp | 8.5.0-1ubuntu0.1+esm3 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | nncp | 8.10.0-8ubuntu0.3+esm3 |
Vulnerabilities 1
-
Medium 6.4
nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in …
References
-
report
https://ubuntu.com/security/CVE-2025-60020