CVE-2026-49846

Received Received - Intake

Path Traversal Vulnerability in libks SignalWire C Products

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-49846

Affected Vendors & Products

Vendor	Product	Version / Range
libks	libks	to 2.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-697	The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

Executive Summary

This vulnerability is in libks, a library supporting SignalWire products. The issue is in the HTTP request parser function clean_uri(), which fails to properly handle URIs with too many path segments. Instead of rejecting these URIs, it allows embedded '..' sequences to remain intact during canonicalization. This enables path traversal attacks in any system that later combines this URI with a filesystem path.

Detection Guidance

This vulnerability involves a path traversal issue in libks versions prior to 2.0.11 due to improper URI canonicalization. To detect it, check the installed version of libks using package managers like 'dpkg -l libks' or 'rpm -qa libks'. If the version is below 2.0.11, the system is vulnerable. No specific commands are provided for runtime detection as it depends on the application using libks.

Impact Analysis

An attacker could exploit this to access files outside the intended directory by crafting malicious URIs. This could lead to unauthorized data exposure, modification, or deletion depending on the application's permissions. Systems using libks versions before 2.0.11 are vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Update libks to version 2.0.11 or later to patch the vulnerability in the HTTP request parser's clean_uri function.

Hi! I’m here to help you understand CVE-2026-49846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70