5.1Medium
CVE-2026-25868MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter
Description
MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application.
Weakness (CWE):
CWE-79
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| gnu | nano | ≤ 0.3.5 | |
| MiniGal | MiniGal Nano | ≤ 0.3.5 | |
| rybber | minigal nano | ≤ 0.3.5 |
References and patches
- https://web.archive.org/web/20180330004313/http://www.minigal.dk/minigal-nano.html productProduct
- https://sourceforge.net/projects/minigalnano/ productProduct
- https://www.vulncheck.com/advisories/minigal-nano-reflected-xss-via-dir-parameter third-party-advisoryThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:rybber:minigal_nano:*:*:*:*:*:*:*:*≤ 0.3.5