CVE-2026-16653 describes a path traversal vulnerability in the boazsegev facil.io project affecting versions up to 0.7.58. The issue is located in the http_sendfile2 function within lib/facil/http/http.c, specifically in the Public Folder Handler component. This vulnerability allows remote attackers to manipulate file paths to access files outside the intended directory. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9, indicating medium severity. Although the project was notified early, no official fix or remediation has been provided yet. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to perform path traversal attacks, potentially reading arbitrary files on the affected system. This can lead to unauthorized disclosure of sensitive information. The vulnerability does not require privileges or user interaction to exploit. The medium CVSS score reflects the moderate impact due to information disclosure risk without direct code execution or system compromise.

No official fix or patch is currently available for this vulnerability, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as restricting access to the affected component or using web application firewalls to detect and block path traversal attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.