CVE-2026-53779 is a path traversal vulnerability in webp_server_go up to version 0.14.4 on Windows platforms. Attackers can send requests containing percent-encoded backslashes (%5C) that circumvent the path.Clean() sanitization in handler/router.go. Because Go normalizes paths using forward slashes only, but Windows treats backslashes and forward slashes as equivalent path separators, this discrepancy allows attackers to access files outside the configured IMG_PATH directory without authentication. This vulnerability enables unauthorized file reading on the host filesystem accessible to the server process.

An unauthenticated attacker can read arbitrary files on the host filesystem outside the intended IMG_PATH directory. This can lead to disclosure of sensitive information accessible by the webp_server_go process on Windows systems. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the webp_server_go service on Windows hosts and monitor for suspicious requests containing percent-encoded backslashes. Avoid exposing the service to untrusted networks. Review and harden file system permissions to limit the impact of potential file disclosure.