CVE-2026-16653
Received Received - Intake

Path Traversal in boazsegev facil.io

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulDB

Description
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-16653
EUVD
EUVD-2026-47867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
boazsegev facil.io to 0.7.58 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the facil.io framework up to version 0.7.58. It exists in the http_sendfile2 function of the public folder handler. The issue allows remote attackers to bypass directory restrictions by sending requests with paths starting with ../, accessing files outside the intended public directory. The exploit is possible due to improper handling of path traversal sequences in the http_sendfile2 function and the HTTP/1 parser accepting request targets without a leading slash.

An attacker could send a request like GET ../secret/secret.txt HTTP/1.1 to access files outside the public folder, such as configuration files or sensitive data, depending on the server's filesystem permissions.

Detection Guidance

To detect this vulnerability, check if facil.io versions up to 0.7.58 are running and if the .public_folder configuration is enabled. Inspect HTTP requests for paths starting with ../ or missing leading slashes. Use tools like curl to test for path traversal by sending requests like GET ../etc/passwd HTTP/1.1.

Impact Analysis

This vulnerability allows unauthorized remote attackers to access sensitive files on the server, including configuration files, application data, secrets, logs, or source code. The impact depends on the server's filesystem permissions and the files stored in the public directory. If exploited, it could lead to data breaches, information disclosure, or further attacks on the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive personal or health data. If exploited, it may result in data breaches that violate privacy requirements, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable the .public_folder configuration in facil.io to prevent static file serving. Update to the latest version if available. Implement input validation to reject paths starting with ../. Restrict filesystem permissions for the server process to limit file access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart