# nnn File Manager Flaws Allow Code Execution

Published: 2026-08-19 · Severity: routine
Canonical: https://vorant.io/reports/b50281ec-3036-5db4-bce5-282e6d0d0af4/nnn-file-manager-flaws-allow-code-execution

> CERT Polska coordinated disclosure of four vulnerabilities in the nnn terminal file manager, including memory corruption and shell-injection bugs that can lead to arbitrary code execution.

CERT Polska, working with researchers from AFINE Team, disclosed four vulnerabilities in nnn, a terminal-based file manager, version 5.2 of which was confirmed vulnerable (no fixed version range was provided by the maintainer). Two of the issues are memory-safety bugs: CVE-2026-65609 is an out-of-bounds write caused by unvalidated length fields in deserialized session files loaded via the -s option, and CVE-2026-65610 is an integer-underflow bug where an overly long HOME path truncates a uchar_t length variable to zero, causing signed-integer promotion to -1 and triggering an out-of-bounds read/write adjacent to a path buffer.

The more severe issues, CVE-2026-65611 and CVE-2026-65612, are shell-injection vulnerabilities. nnn fails to sanitize directory and file names before embedding them into shell commands used for batch copy/move and preview-tabbed operations. An attacker who can plant a maliciously named directory or file on shared storage, removable media, or inside an extracted archive can achieve command injection with the privileges of the nnn process once the victim interacts with that path through the affected workflows.

Exploitation in all four cases requires the victim to load a malicious session file, use an attacker-influenced HOME variable, or browse into a booby-trapped directory/file — meaning these are primarily local or social-engineering-driven attack vectors (e.g., shared drives, USB media, or malicious archives) rather than remotely exploitable network flaws. No active exploitation has been reported; this is a coordinated vulnerability disclosure rather than an in-the-wild threat.

## Mentioned in this report

- Vulnerabilities: CVE-2026-65609, CVE-2026-65610, CVE-2026-65611, CVE-2026-65612

## Detection guidance (public sample)

### nnn File Manager Spawning Shell With Injection Metacharacters

ATT&CK: T1059.004

Detects nnn spawning a shell interpreter with a command line containing shell metacharacters, consistent with exploitation of the batch copy/move or preview-tabbed shell-injection flaws (CVE-2026-65611/65612) via maliciously named files/directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: nnn File Manager Spawning Shell With Injection Metacharacters
description: Detects the nnn terminal file manager spawning a shell (sh/bash/dash)
  whose command line contains shell metacharacters such as pipes, backticks, command
  substitution or chaining operators. nnn's batch copy/move and preview-tabbed features
  build shell commands from unsanitized directory/file names, so a maliciously named
  path can inject arbitrary commands once the user interacts with it (CVE-2026-65611,
  CVE-2026-65612). Generalises on the parent/child relation and the presence of shell
  metacharacters rather than any specific payload.
tags:
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /nnn
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
  filter_nnn_plugins:
    CommandLine|contains: .config/nnn/plugins
  condition: selection and not filter_nnn_plugins
falsepositives:
- User-authored nnn plugins or NNN_FIFO scripts that legitimately invoke shell pipelines
- Custom keybindings that call external tools with pipe/redirect syntax on trusted
  filenames
level: high
id: bf2c3c76-a3fd-5df1-856a-e6c7f08c6c4d
status: experimental
author: Vorant
```

### nnn Session File Loaded From Untrusted or Removable Location

ATT&CK: T1204.002

Detects nnn invoked with the -s (session load) flag against a session file located in a removable-media, temp, or shared-mount path, matching the delivery vector for the session-deserialization out-of-bounds write (CVE-2026-65609). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: nnn Session File Loaded From Untrusted or Removable Location
description: Detects nnn being launched with the -s option to load a saved session
  file from a non-standard path such as removable media, a mounted share, or a temp
  directory. nnn's session deserialization does not validate embedded length fields,
  so a crafted session file placed on shared/removable storage can trigger an out-of-bounds
  write once the victim loads it (CVE-2026-65609). Generalises on the -s flag plus
  an untrusted source path rather than any specific filename.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    Image|endswith: /nnn
    CommandLine|contains: -s
  selection_untrusted_path:
    CommandLine|contains:
    - /media/
    - /mnt/
    - /run/media/
    - /tmp/
    - /Downloads/
  condition: selection_cmd and selection_untrusted_path
falsepositives:
- Administrators intentionally restoring nnn sessions saved to a shared network mount
  as part of normal workflow
- Users who keep their nnn session files inside a Downloads folder by personal convention
level: medium
id: 428e3780-0f28-5deb-81eb-ba3f8231e8d6
status: experimental
author: Vorant
```

### File or Directory Created With Shell Metacharacters on Removable or Shared Media

ATT&CK: T1204.002

Detects creation of files or directories whose names contain shell metacharacters on removable/shared mount points, the staging step for planting a booby-trapped path that triggers nnn's shell-injection bugs when browsed or batch-processed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: File or Directory Created With Shell Metacharacters on Removable or Shared
  Media
description: Detects filesystem entries created on removable media, mounted shares,
  or extracted-archive staging paths whose names embed shell metacharacters (semicolons,
  backticks, pipes, command substitution). This matches the attacker precondition
  for CVE-2026-65611/65612, where a maliciously named directory or file is planted
  so that nnn's unsanitized batch copy/move or preview-tabbed commands execute injected
  shell code once the victim browses or acts on it.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: linux
detection:
  selection_name:
    TargetFilename|contains:
    - ;
    - '`'
    - $(
    - '|'
    - '&&'
  selection_path:
    TargetFilename|contains:
    - /media/
    - /mnt/
    - /run/media/
  condition: selection_name and selection_path
falsepositives:
- Legitimate files copied from systems using differing filename conventions that happen
  to include allowed special characters
- Archive extraction tools that preserve unusual filenames from cross-platform sources
level: medium
id: df104ac2-896c-5102-9139-a62c4fd55240
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-65609

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b50281ec-3036-5db4-bce5-282e6d0d0af4/nnn-file-manager-flaws-allow-code-execution.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup