CVE-2026-43982
Directory Traversal in Algernon Web Server
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xyproto | algernon | to 1.17.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a path traversal issue in the Algernon web server versions prior to 1.17.6. The function uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() to combine a user-supplied directory with a file path but does not validate the resulting path. This allows an attacker to use directory traversal sequences like ../../../tmp to write files outside the intended web root directory, potentially to arbitrary system locations.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to write files to arbitrary locations on the system where Algernon is running. This can lead to unauthorized file writes outside the web root, including sensitive system directories such as /tmp or user directories like /home/algernon. The impact is especially severe if Algernon runs with root privileges, as it could allow modification of critical system files or placing malicious files on the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the Algernon web server version is prior to 1.17.6, as these versions contain the path traversal flaw in the uploadedFileSaveIn() function.
One approach is to verify the version of Algernon running on your system by executing a command to display the version, for example:
- algernon --version
Additionally, monitoring for suspicious file writes outside the web root directory, such as unexpected files appearing in system directories like /tmp or user home directories, may indicate exploitation attempts.
Network detection could involve inspecting HTTP requests for directory traversal patterns in file upload parameters, such as sequences like '../../../'.
What immediate steps should I take to mitigate this vulnerability?
The primary and strongly recommended mitigation step is to upgrade Algernon to version 1.17.6 or later, where this vulnerability has been fixed.
If upgrading immediately is not possible, consider applying stricter systemd service file configurations to limit the directories Algernon can write to, reducing the risk of arbitrary file writes.
Another workaround is to add additional boundary checks in the Lua upload logic to validate and sanitize user-supplied directory paths before joining them, preventing directory traversal.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows directory traversal and arbitrary file writes outside the intended web root, potentially enabling unauthorized access or modification of sensitive files.
Such unauthorized file access or modification could lead to breaches of data confidentiality and integrity, which are critical requirements under common standards and regulations like GDPR and HIPAA.
If exploited, this vulnerability could result in exposure or alteration of personal or protected health information, thereby impacting compliance with these regulations.
Mitigation by upgrading to version 1.17.6 or applying stricter controls is necessary to maintain compliance and reduce risk.