The vulnerability in Nging 5.3.5 allows any authenticated backend user, even those without file‑manager permission, to enumerate server directories by supplying arbitrary paths to the /user/autocomplete_path endpoint. This results in disclosure of the host directory structure and the presence of specific files, exposing sensitive information about the system. The weakness is a missing authorization check, identified as CWE-862.

The affected product is Nging from admpub, specifically version 5.3.5. No other product versions are listed in the CNA data.

With a CVSS score of 5.3 the vulnerability is considered medium severity. No EPSS score is available and the issue is not listed in CISA KEV. The attack requires authentication to a backend account; an attacker can trivially supply a path query to enumerate directories readable by the Nging process. Because the endpoint is public‑tagged, local or remote users with any backend credentials can exploit this without further access prerequisites, making the risk moderate to high for organizations that rely on restricted backend access controls.