CVE-2026-52792: CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream in xyproto algernon
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.
AI Analysis
Technical Summary
Algernon versions before 1.17.9 on Windows improperly handle file extensions with NTFS Alternate Data Stream suffixes (e.g., x.lua::$DATA). The server uses filepath.Ext() without rejecting these suffixes, allowing unauthenticated clients to append such suffixes to requests for public server-side scripts with specific extensions (.lua, .tl, .po2, .amber, .frm). The request bypasses script rendering and execution, resulting in the server returning the raw script source code. This behavior can leak sensitive data including database credentials, API keys, and the SetCookieSecret, which could enable session cookie forgery. Linux and macOS hosts are unaffected. The vulnerability is addressed in Algernon version 1.17.9.
Potential Impact
An unauthenticated attacker can retrieve raw source code of server-side scripts on Windows hosts running vulnerable Algernon versions. This exposure can lead to leakage of sensitive information such as database credentials, API keys, and session secrets, potentially allowing session cookie forgery. The vulnerability does not affect non-Windows platforms.
Mitigation Recommendations
This vulnerability is fixed in Algernon version 1.17.9. Users should upgrade to version 1.17.9 or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
CVE-2026-52792: CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream in xyproto algernon
Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Algernon versions before 1.17.9 on Windows improperly handle file extensions with NTFS Alternate Data Stream suffixes (e.g., x.lua::$DATA). The server uses filepath.Ext() without rejecting these suffixes, allowing unauthenticated clients to append such suffixes to requests for public server-side scripts with specific extensions (.lua, .tl, .po2, .amber, .frm). The request bypasses script rendering and execution, resulting in the server returning the raw script source code. This behavior can leak sensitive data including database credentials, API keys, and the SetCookieSecret, which could enable session cookie forgery. Linux and macOS hosts are unaffected. The vulnerability is addressed in Algernon version 1.17.9.
Potential Impact
An unauthenticated attacker can retrieve raw source code of server-side scripts on Windows hosts running vulnerable Algernon versions. This exposure can lead to leakage of sensitive information such as database credentials, API keys, and session secrets, potentially allowing session cookie forgery. The vulnerability does not affect non-Windows platforms.
Mitigation Recommendations
This vulnerability is fixed in Algernon version 1.17.9. Users should upgrade to version 1.17.9 or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mm6c-5j6x-hq8m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52792"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a46ecae27e9c7971943b8e1
Added to database: 07/02/2026, 22:56:46 UTC
Last enriched: 08/20/2026, 11:29:40 UTC
Last updated: 09/13/2026, 01:37:47 UTC
Views: 138
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.