Executive Summary

CVE-2026-53779 is a path traversal vulnerability in WebP Server Go versions prior to 0.15.0 on Windows systems. It allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests containing percent-encoded backslashes (%5C).

The root cause is a mismatch between Go's path normalization, which only uses forward slashes, and Windows file system APIs that treat backslashes and forward slashes as equivalent. This discrepancy allows attackers to bypass the path.Clean() sanitization in the handler/router.go file and access arbitrary files on the server's filesystem accessible to the server process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to read sensitive files on the server outside the intended image directory without authentication. This unauthorized file access can lead to exposure of confidential information, configuration files, or other sensitive data accessible to the server process.

Because the vulnerability has a high severity rating (CVSS 8.7), it poses a significant security risk, potentially enabling attackers to gather information that could be used for further attacks or exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests containing percent-encoded backslashes (%5C) targeting the WebP Server Go on Windows systems. Such requests attempt to exploit the path traversal flaw by bypassing path sanitization.

You can use network traffic inspection tools or web server logs to search for suspicious requests with %5C sequences in the URL paths.

• Using grep on server logs to find requests with %5C: grep "%5C" access.log
• Using tcpdump or Wireshark to capture HTTP traffic and filter for %5C in URLs.
• Using curl or similar tools to test the server by sending crafted requests with %5C sequences and observing if files outside IMG_PATH are accessible.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade WebP Server Go to version 0.15.0 or later, where the vulnerability has been fixed.

The fix removes the vulnerable proxy mode logic and hardens path handling to prevent path traversal attacks, including encoded variants.

Until the upgrade can be applied, consider restricting access to the WebP Server Go service from untrusted networks and monitoring for suspicious requests containing percent-encoded backslashes.

Useful 0 Not Useful 0