PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48126 xyproto CVE debrief

A path traversal vulnerability in Algernon web server allows arbitrary file read, directory listing, and server-side Lua execution when the server is started with --domain or --letsencrypt flags. The vulnerability exists because the request handler uses filepath.Join to combine the configured --dir with the client-supplied Host header without validation, enabling directory traversal via a Host: .. header. This exposes the parent directory of the document root. The issue is fixed in version 1.17.8.

Vendor
xyproto
Product
algernon
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

Organizations running Algernon web server with --domain or --letsencrypt flags enabled; security teams managing Go-based web infrastructure; developers using Algernon for production deployments

Technical summary

The Algernon web server (pure-Go, self-contained) contains a path traversal vulnerability in its request handler when started with --domain or --letsencrypt flags. The server constructs the served directory path by joining the configured --dir with the raw Host header value using filepath.Join. Without validation, a malicious Host header containing .. traverses one level above the document root. This grants attackers arbitrary file read access, full directory listing capabilities, and server-side Lua execution if .lua files exist in the exposed parent directory. The vulnerability is remotely exploitable without authentication.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Algernon to version 1.17.8 or later
  • If immediate upgrade is not possible, avoid using --domain or --letsencrypt flags
  • Implement reverse proxy with Host header validation as a temporary mitigation
  • Review server logs for requests with Host headers containing path traversal sequences (..)
  • Audit parent directories of document roots for sensitive files or .lua scripts that could enable code execution

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-jc3j-x6pg-4hmv. CVSS 3.1 score 8.2 (HIGH). Affected versions: prior to 1.17.8. Fixed version: 1.17.8. Attack vector: network, low complexity, no privileges required, no user interaction. Impact: high confidentiality, low integrity, no availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48126 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48126

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48126 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48126

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.