CVE-2026-48126: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in xyproto algernon
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.
AI Analysis
Technical Summary
Algernon, a pure-Go web server, improperly handles the Host header when started with --domain or --letsencrypt options by joining the configured directory with the Host header value using filepath.Join without validation. This allows path traversal attacks that can expose files outside the intended document root, including arbitrary file reads, directory listings, and server-side Lua execution if .lua files are present. Versions prior to 1.17.8 are affected. The issue is addressed in version 1.17.8.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized disclosure of files outside the web root, full directory listings, and potential remote code execution via server-side Lua scripts. The confidentiality impact is high, integrity impact is low, and availability is not affected. This can compromise sensitive data and potentially allow attackers to execute arbitrary code on the server if Lua files are present.
Mitigation Recommendations
This vulnerability is fixed in algernon version 1.17.8. Users should upgrade to version 1.17.8 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-48126: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in xyproto algernon
Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.
CVSS v3.1
Score 8.2high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Algernon, a pure-Go web server, improperly handles the Host header when started with --domain or --letsencrypt options by joining the configured directory with the Host header value using filepath.Join without validation. This allows path traversal attacks that can expose files outside the intended document root, including arbitrary file reads, directory listings, and server-side Lua execution if .lua files are present. Versions prior to 1.17.8 are affected. The issue is addressed in version 1.17.8.
Potential Impact
Exploitation of this vulnerability can lead to unauthorized disclosure of files outside the web root, full directory listings, and potential remote code execution via server-side Lua scripts. The confidentiality impact is high, integrity impact is low, and availability is not affected. This can compromise sensitive data and potentially allow attackers to execute arbitrary code on the server if Lua files are present.
Mitigation Recommendations
This vulnerability is fixed in algernon version 1.17.8. Users should upgrade to version 1.17.8 or later to remediate this issue. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:46:58.291Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a15d22e891d628fdc6008a2
Added to database: 5/26/2026, 5:02:38 PM
Last enriched: 5/26/2026, 5:17:50 PM
Last updated: 5/26/2026, 9:50:07 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.