CVE-2026-52792
Received Received - Intake

Remote Script Source Exposure in Algernon Web Server

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-52792
EUVD
EUVD-2026-62506

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
labstack algernon 1.17.9
xyproto algernon to 1.17.9 (exc)
xyproto algernon 1.17.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-69 The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52792 is a server-side script source disclosure vulnerability affecting the Algernon web server on Windows systems using NTFS filesystems. The issue occurs because Algernon's file handler fails to properly recognize NTFS-equivalent filenames like x.lua::$DATA, x.lua., or x.lua as valid script extensions. This allows unauthenticated attackers to append these suffixes to public script paths, bypassing execution and receiving the raw source code of server-side scripts instead.

Detection Guidance

Check if your Algernon server is running on Windows with NTFS. Test for the vulnerability by appending NTFS-equivalent suffixes like ::$DATA, ., or space to script paths (e.g., /script.lua::$DATA). If raw source code is returned instead of execution, the system is vulnerable.

Impact Analysis

This vulnerability can expose sensitive information such as database credentials, API keys, and the SetCookieSecret value stored in server-side scripts. If the SetCookieSecret is compromised, it may permit forged session cookies, leading to session hijacking. The attack requires no special privileges or user interaction, making it highly exploitable remotely.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. Raw script source disclosure may reveal hardcoded database credentials, API keys, and SetCookieSecret values, which could result in unauthorized access to personal or protected health information. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could lead to regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Algernon to version 1.17.9 or later. Ensure the server is not running on Windows with NTFS if possible. Monitor logs for suspicious requests with appended suffixes like ::$DATA, ., or space.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart