GNU nano up to 8.x Local Directory Page ~/.local permission assignment

Summaryinfo

A vulnerability marked as problematic has been reported in GNU nano up to 8.x. This issue affects some unknown processing of the file ~/.local of the component Local Directory Page. Performing a manipulation results in permission assignment. This vulnerability is cataloged as CVE-2026-40556. The attack must be initiated from a local position. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in GNU nano up to 8.x. It has been classified as problematic. This affects an unknown code of the file ~/.local of the component Local Directory Page. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on integrity. The summary by CVE is:

GNU nano creates the user’s ~/.local directory with overly permissive permissions when the directory does not exist yet. On first use of features requiring Cross-Desktop Group (XDG) data storage, nano explicitly requests directory mode 0777, making the directory world‑writable in environments where the process umask does not sufficiently restrict permissions. In systems with a relaxed or zero umask, such as container environments, CI/CD runners, embedded systems, or user shells configured with umask 000, this results in ~/.local being created as world‑writable. A local attacker can exploit a race window between nano’s creation of ~/.local and its subsequent creation of more restrictive subdirectories to write attacker‑controlled files into the victim’s XDG directory hierarchy. This problem was fixed in nano version 9.0

The weakness was shared by Michal Majchrowicz. It is possible to read the advisory at cert.pl. This vulnerability is uniquely identified as CVE-2026-40556 since 04/14/2026. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 324062 (openSUSE 16 Security Update : nano (openSUSE-SU-2026:21166-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at cgit.git.savannah.gnu.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (324062) and EUVD (EUVD-2026-26053). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• GNU

Name

• nano

Version

• 8.x

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion