The specific flaw exists within the handling of environment variables. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-28644.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| NoMachine | NoMachine | unknown |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-26-247/ |
|
Sat, 11 Apr 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | NoMachine External Control of File Path Arbitrary File Deletion Vulnerability. This vulnerability allows local attackers to delete arbitrary files on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of environment variables. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-28644. | |
| Title | NoMachine External Control of File Path Arbitrary File Deletion Vulnerability | |
| Weaknesses | CWE-73 | |
| References |
| |
| Metrics |
cvssV3_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2026-04-11T00:14:07.656Z
Reserved: 2026-03-27T18:05:32.535Z
Link: CVE-2026-5053
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-11T01:16:17.757
Modified: 2026-04-11T01:16:17.757
Link: CVE-2026-5053
Redhat
No data.
OpenCVE Enrichment
No data.