CVE-2026-73255 cesanta CVE debrief

Who should care

Defenders responsible for deployments using Mongoose with MG_ENABLE_SSI and ssi_pattern configured should assess exposure and prioritize upgrading to version 7.22 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and remediate the vulnerability.

Why it matters

CVE-2026-73255 allows for file disclosure via directory traversal sequences in SSI-enabled files in Mongoose prior to version 7.22, impacting MG_ENABLE_SSI deployments with ssi_pattern configured. Defenders should verify exposure and prioritize upgrading to version 7.22 or later.

• File disclosure via directory traversal sequences in SSI-enabled files.
• Potential exposure of sensitive files readable by the Mongoose process.
• Verification of MG_ENABLE_SSI deployments and ssi_pattern configuration is necessary.
• Upgrade to Mongoose version 7.22 or later to remediate the vulnerability.

Technical summary

Mongoose, an embedded web server and network library, is vulnerable to file disclosure via directory traversal sequences in SSI-enabled files prior to version 7.22. An attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive, allowing disclosure of files readable by the Mongoose process in MG_ENABLE_SSI deployments with ssi_pattern configured.

Defensive priority

Defenders should prioritize verifying exposure in MG_ENABLE_SSI deployments and upgrading to Mongoose version 7.22.

Recommended defensive actions

• Verify if MG_ENABLE_SSI is deployed and ssi_pattern is configured.
• Inventory Mongoose deployments to identify versions prior to 7.22.
• Upgrade to Mongoose version 7.22 or later.
• Monitor for unusual file access patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Mongoose prior to version 7.22, which allows for file disclosure via directory traversal sequences in SSI-enabled files. The issue is fixed in version 7.22. Defenders should verify exposure in MG_ENABLE_SSI deployments and ssi_pattern configurations. The CVE record was published on 2026-08-20T18:16:46.313Z and has not been modified since then. There are references to the fix in Mongoose version 7.22 and security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.