CVE-2000-1109: Midnight Commander (mc) 4.5.51 and earlier does not properly process malformed directory names when a user...

Security readout for executives and security teams

A local user could abuse how Midnight Commander 4.5.51 and earlier handled malformed directory names. If a privileged user opened such a directory in mc, unintended command execution could occur, potentially raising the attacker’s privileges. This is mainly a legacy Unix/Linux exposure, not a remote internet-facing flaw. Exposure is most likely on old systems still running Midnight Commander 4.5.51 or earlier, especially shared shell, hosting, lab, or administrative Unix/Linux environments where untrusted local users can create directories later opened by privileged users. Handle as a legacy privilege-escalation hygiene issue. It is not evidenced as internet-exploited here, but affected shared systems could allow a low-privileged local user to gain higher privileges if administrators use vulnerable mc in attacker-controlled paths. Mitigation focus: Inventory systems for Midnight Commander and package versions.; Upgrade Midnight Commander using current vendor or distribution guidance.; Prioritize shared systems with untrusted local shell access..

Prepared

Jul 1, 2026, 09:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.