CVE-2026-40556

NameCVE-2026-40556
DescriptionGNU nano creates the user’s ~/.local directory with overly permissive permissions when the directory does not exist yet. On first use of features requiring Cross-Desktop Group (XDG) data storage, nano explicitly requests directory mode 0777, making the directory world‑writable in environments where the process umask does not sufficiently restrict permissions. In systems with a relaxed or zero umask, such as container environments, CI/CD runners, embedded systems, or user shells configured with umask 000, this results in ~/.local being created as world‑writable. A local attacker can exploit a race window between nano’s creation of ~/.local and its subsequent creation of more restrictive subdirectories to write attacker‑controlled files into the victim’s XDG directory hierarchy. This problem was fixed in nano version 9.0
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nano (PTS)bullseye5.4-2+deb11u3vulnerable
bookworm7.2-1+deb12u1vulnerable
trixie8.4-1vulnerable
forky, sid9.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nanosource(unstable)9.0-1

Notes

[trixie] - nano <no-dsa> (Minor issue)
[bookworm] - nano <no-dsa> (Minor issue)
Fixed by: https://cgit.git.savannah.gnu.org/cgit/nano.git/commit/?id=cb43493e00e5777d2433ecf5db6402983b282d6f (v9.0)
Duplicate CVE assignment for CVE-2026-6842.

Search for package or bug name: Reporting problems