CVE-2025-60020: NNCP Path Traversal Vulnerability

CVE-2025-60020 Overview

CVE-2025-60020 is a path traversal vulnerability in NNCP (Node to Node Copy) versions prior to 8.12.0. The flaw allows an attacker to read or write files outside intended directories through crafted paths embedded in packet data. The issue affects the freqing (file request) and file saving operations of NNCP, a store-and-forward network utility used for asynchronous data exchange between nodes.

The vulnerability is classified under CWE-23: Relative Path Traversal and requires an authenticated peer relationship to exploit.

Critical Impact
An authenticated remote peer can read or write arbitrary files on a receiving NNCP node by supplying a crafted path in packet data, undermining the trust boundary between paired nodes.

Affected Products

NNCP versions prior to 8.12.0
Deployments using freq (file request) functionality between paired nodes
Deployments performing inbound file saving from remote NNCP peers

Discovery Timeline

2025-09-24 - CVE-2025-60020 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60020

Vulnerability Analysis

NNCP is a suite of utilities for secure store-and-forward file, mail, and command exchange between nodes over any transport. Nodes exchange encrypted packets that may include filenames and paths. The vulnerable code paths handle two operations: freq requests (where one node requests a file from another) and inbound file save operations on the receiving side.

When processing packet data containing filename or path fields, NNCP versions prior to 8.12.0 did not sufficiently canonicalize or validate the supplied path. An attacker who is a valid NNCP peer can embed traversal sequences such as ../ to escape the configured spool or freq directory.

The attack scope is Changed because a compromise of the NNCP process boundary allows access to files owned by other users or system files, depending on the privileges of the NNCP daemon or invoking user.

Root Cause

The root cause is insufficient validation of relative path components in filename fields carried inside NNCP packet payloads. See the NNCP 8.12.0 release notes for the maintainer's description of the fix and the nncp-devel mailing list post for the disclosure discussion.

Attack Vector

Exploitation requires the attacker to be an authorized NNCP peer or to control an intermediate node that can inject crafted packets. The attacker constructs a packet whose filename or freq path contains traversal sequences pointing outside the intended spool directory. On packet processing, the receiving node writes attacker-controlled content to, or reads content from, the traversed path. No user interaction is required on the target node.

Detection Methods for CVE-2025-60020

Indicators of Compromise

Files written by the NNCP process outside of the configured spool or freq directories
Unexpected file access or modification timestamps on system files owned by the user running NNCP
NNCP log entries referencing filenames containing ../, ..\, or URL-encoded traversal sequences
Freq requests from remote peers targeting paths outside advertised freq directories

Detection Strategies

Enable verbose NNCP logging and search inbound packet metadata for path components containing .. separators
Perform file integrity monitoring on directories adjacent to the NNCP spool root to detect out-of-scope writes
Correlate NNCP peer identifiers with any file-write events originating from the NNCP process outside expected paths

Monitoring Recommendations

Audit execve and file-open syscalls from the NNCP process using auditd or eBPF-based telemetry
Alert on any NNCP-originated writes to directories outside the configured spool tree
Review peer authorization lists and remove any peers that are no longer required to reduce the attack surface

How to Mitigate CVE-2025-60020

Immediate Actions Required

Upgrade NNCP to version 8.12.0 or later on all nodes that receive packets or process freq requests
Inventory all NNCP peers and validate that only trusted, authorized nodes remain in the configuration
Run the NNCP daemon under a dedicated unprivileged user with minimal filesystem access outside the spool directory

Patch Information

The NNCP project fixed the issue in release 8.12.0. Refer to the NNCP 8.12.0 release notes for the upstream fix and upgrade instructions. All prior versions are affected.

Workarounds

Restrict NNCP peers to a minimal set of fully trusted nodes until patching is complete
Constrain the NNCP process filesystem view using OS-level sandboxing such as systemd unit ProtectSystem=strict, ReadWritePaths=, or a chroot
Place the NNCP spool on a dedicated filesystem or mount with nosuid and nodev to limit the impact of unauthorized writes
Disable freq functionality on nodes that do not require it

bash

# Example systemd hardening for the NNCP service unit
[Service]
User=nncp
Group=nncp
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ReadWritePaths=/var/spool/nncp