Algernon's file handler selection uses filepath.Ext() which does not recognize NTFS-equivalent filename suffixes like '::$DATA', trailing dots, or trailing spaces as script extensions (e.g., '.lua'). On Windows, these suffixes resolve to the original file's data stream, causing Algernon to bypass script execution and instead serve the raw source code. This allows unauthenticated clients to access server-side script source files on public paths, exposing sensitive embedded secrets such as database connection strings and the SetCookieSecret value. The issue arises because Algernon does not canonicalize or reject Windows-equivalent filenames before dispatching handlers, leading to a confidentiality breach.

An attacker can read the exact source code of any server-side script served on a public path by Algernon on Windows hosts. This disclosure exposes hardcoded secrets including database credentials and session cookie secrets. The leaked SetCookieSecret enables forging of session cookies, allowing unauthenticated attackers to impersonate any user. This results in a high confidentiality impact and complete authentication bypass without requiring any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor suggests rejecting request paths whose final segment contains Windows-equivalent filename forms such as alternate data stream suffixes ('::$DATA'), trailing dots, or trailing spaces before extension dispatch. Until a patch is available, administrators should avoid serving server-side scripts on public paths on Windows hosts or implement access controls to prevent unauthenticated access. Monitoring for suspicious requests using these filename suffixes may help detect exploitation attempts.