A vulnerability exists in the kalyan02 NanoCMS component that handles user information. The flaw resides in the /data/pagesdata.txt file, which can be accessed directly when a specific manipulation is performed. The result is a direct request to the file and the exposure of potentially sensitive user data. The attack can be initiated remotely, allowing an adversary to retrieve this information without authentication.

kalyan02 NanoCMS versions up to and including 0.4 are affected. The vulnerability is tied to the User Information Handler attempting to read or expose the pagesdata.txt file. No later versions have been identified as unpatched for this issue.

The CVSS score of 6.9 denotes a moderate severity, with an EPSS of less than 1% indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted HTTP requests to the NanoCMS instance. Since the exploit is publicly available and requires only a remote request, organizations running affected versions face a moderate risk that could lead to unauthorized disclosure of user information if the file is accessible over the network.