CVE-2026-25869: Minigal Nano Path Traversal Vulnerability

CVE-2026-25869 Overview

CVE-2026-25869 is a path traversal vulnerability in MiniGal Nano versions 0.3.5 and prior. The flaw exists in index.php and stems from improper handling of the dir parameter. The application appends user-controlled input to the photos directory and attempts to strip dot-dot sequences, but attackers can bypass this filter with crafted directory patterns. Successful exploitation causes the gallery to enumerate and display image files from unintended filesystem locations readable by the web server, resulting in information disclosure [CWE-22].

Critical Impact
Remote, unauthenticated attackers can enumerate image files outside the intended photos directory, exposing files readable by the web server process.

Affected Products

Rybber MiniGal Nano 0.3.5
Rybber MiniGal Nano versions prior to 0.3.5
MiniGal Nano deployments using the index.php gallery endpoint

Discovery Timeline

2026-02-11 - CVE-2026-25869 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-25869

Vulnerability Analysis

MiniGal Nano is a lightweight PHP photo gallery distributed through SourceForge. The gallery exposes an index.php endpoint that accepts a dir query parameter to control which subdirectory of the photos folder is rendered. The application concatenates the attacker-supplied value onto the gallery base path before enumerating image files.

To prevent directory traversal, the application strips .. sequences from the input. This sanitization is incomplete. Crafted input patterns survive the filter and resolve, after PHP path normalization, to directories above the intended gallery root. The web server then lists and renders image files from those locations.

The issue maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The exposure is limited to files readable by the web server user and to file types the gallery treats as images, so impact centers on information disclosure rather than code execution.

Root Cause

The root cause is reliance on string-based blacklist filtering instead of canonical path validation. Removing .. substrings does not account for overlapping or recursive patterns that reconstruct traversal sequences after replacement. The application also fails to verify that the resolved path remains within the configured photos directory before performing filesystem operations.

Attack Vector

The vulnerability is network-reachable and requires no authentication or user interaction. An attacker issues a GET request to index.php with a malicious dir value designed to bypass the dot-dot filter. The application resolves the path outside the gallery root and returns a listing of any image files present. Refer to the VulnCheck Advisory on MiniGalNano for technical details on the bypass pattern.

Detection Methods for CVE-2026-25869

Indicators of Compromise

Web server access logs showing requests to index.php containing dir= values with .., encoded dot sequences, or unusual nested directory patterns.
Outbound responses from index.php referencing image filenames located outside the configured photos directory.
Repeated dir parameter probing from a single source enumerating common system paths.

Detection Strategies

Inspect HTTP request logs for dir parameter values that deviate from expected gallery subdirectory names.
Deploy WAF or reverse proxy rules that flag traversal patterns including .., ...., ..%2f, and overlapping dot sequences in query strings.
Correlate gallery requests with filesystem reads outside the application root using host-based file access auditing.

Monitoring Recommendations

Enable verbose HTTP request logging on the web server hosting MiniGal Nano and forward logs to centralized analytics.
Alert on anomalous response sizes or image enumeration counts returned by index.php.
Audit the web server user's filesystem read activity for accesses outside the gallery directory.

How to Mitigate CVE-2026-25869

Immediate Actions Required

Restrict public access to MiniGal Nano instances until a patched build is deployed.
Run the gallery under a dedicated low-privilege account whose readable filesystem scope is limited to the photos directory.
Add WAF rules that reject index.php requests containing traversal sequences in the dir parameter.

Patch Information

No vendor patch is referenced in the published CVE record. MiniGal Nano is an end-of-life project archived on SourceForge. Review the SourceForge MiniGalNano Project and the VulnCheck Advisory on MiniGalNano for the latest status, and consider migrating to a maintained gallery application.

Workarounds

Place MiniGal Nano behind authentication using a reverse proxy or .htaccess access controls.
Implement a server-side allowlist of permitted dir values and reject any input that does not match.
Use filesystem chroot or container isolation to limit the directories the web server process can read.

bash

# Example Apache rewrite rule to block traversal patterns in dir parameter
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)dir=[^&]*(\.\.|%2e%2e|%252e) [NC]
RewriteRule ^index\.php$ - [F,L]