The vulnerability in xyproto algernon (before version 1.17.6) involves improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the uploadedFileSaveIn() function in lua/upload/upload.go joins a user-supplied directory path without validating that the resulting path remains within the intended web root. This allows directory traversal attacks where an attacker can write files outside the web root, potentially leading to unauthorized file writes in arbitrary locations such as /tmp. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, and was fixed in version 1.17.6.

Successful exploitation allows an unauthenticated attacker to write files outside the designated web root directory by supplying crafted directory paths. This can lead to unauthorized file creation or overwriting in arbitrary filesystem locations, which may facilitate further attacks or system compromise. There are no known exploits in the wild at this time.

Upgrade xyproto algernon to version 1.17.6 or later, where this path traversal vulnerability has been fixed. Since the vendor has released a fixed version, applying this official patch is the recommended remediation. Patch status is confirmed by the vendor advisory indicating the fix in version 1.17.6.