CVE-2026-73255
Received Received - Intake

Directory Traversal in Mongoose Web Server

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73255
EUVD
EUVD-2026-63499

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose 7.22
cesanta mongoose to 7.22 (exc)
cesanta mongoose 7.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the Mongoose web server library affecting version 7.21. When Server-Side Includes (SSI) are enabled, the mg_ssi() function processes include directives without properly sanitizing the path argument. This allows attackers who can write to an .shtml file to use directory traversal sequences like ../ to read arbitrary files on the server.

Detection Guidance

Check if your Mongoose version is 7.21 or earlier by running: mongoose --version or checking your package manager. Inspect .shtml files for SSI include directives like <!--#include file="../etc/passwd"--> or <!--#include virtual="../etc/shadow"-->. Use curl to test for path traversal by requesting a crafted .shtml file containing malicious SSI directives.

Impact Analysis

An attacker could read sensitive files on the server, including /etc/passwd, /etc/shadow (if running as root), application configurations, private keys, and database credentials. Exploitation involves crafting an .shtml file with malicious SSI include directives and requesting it via HTTP.

Mitigation Strategies

Upgrade Mongoose to version 7.22 or later immediately. Disable Server-Side Includes (SSI) if not required by setting ssi_pattern to an empty string. Restrict write access to .shtml files to trusted users only. Monitor for unusual file access patterns in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart