CVE-2026-53779 is a path traversal vulnerability in webp_server_go up to version 0.14.4 on Windows platforms. Attackers can send requests containing percent-encoded backslashes (%5C) to circumvent the path.Clean() sanitization function in handler/router.go. Because Go normalizes paths using forward slashes only, but Windows treats backslashes and forward slashes as equivalent path separators, this discrepancy enables unauthorized reading of files outside the configured IMG_PATH directory. The vulnerability does not require authentication and has a CVSS 4.0 score of 8.7, indicating high severity.

An unauthenticated attacker can read arbitrary files on the host filesystem accessible to the webp_server_go process on Windows. This can lead to disclosure of sensitive information stored outside the intended image directory. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the webp_server_go service on Windows hosts and monitor for suspicious requests containing encoded backslashes. Avoid exposing the service to untrusted networks. Follow vendor updates for an official patch or workaround.