CVE-2026-105144: Path Traversal in Drogon

A path traversal vulnerability exists in the StaticFileRouter::route function of the Drogon web framework (lib/src/StaticFileRouter.cc) on Windows platforms. The flaw allows remote attackers to manipulate file paths, potentially accessing files outside the intended directory. Affected versions include 1.9.13-1 and beta versions 10.0-beta.0 through 10.0-beta.3. The vulnerability has been publicly disclosed with exploit code available. The vendor was contacted but has not provided any response or fix.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal attacks, potentially accessing sensitive files on the affected system. This could lead to information disclosure or other impacts depending on the files accessed. The CVSS score of 6.9 indicates a medium severity level with network attack vector and no required privileges or user interaction.

No official patch or fix is currently available from the vendor. Users should monitor vendor channels for updates. In the meantime, restricting access to the affected service and implementing network-level controls to limit exposure may reduce risk. Since exploit code is publicly available, caution is advised.