CVE-2026-105144
Received Received - Intake

Path Traversal in Drogon Web Framework

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105144
EUVD
EUVD-2026-92087

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in Drogon versions up to 1.9.13-1 or 10.0-beta.3 on Windows. It exists in the StaticFileRouter::route function of the StaticFileRouter.cc file. An attacker can manipulate inputs to access unauthorized files or directories remotely. The exploit has been publicly disclosed and may already be in use.

Detection Guidance

This vulnerability involves a path traversal flaw in Drogon's StaticFileRouter on Windows. To detect it, check if your Drogon version is up to 1.9.13-1 or 10.0-beta.3. Inspect network traffic for unusual file access patterns or requests containing path traversal sequences like '../'. Monitor logs for unauthorized file access attempts.

Impact Analysis

If you use an affected version of Drogon on Windows, an attacker could read sensitive files outside the intended directory. This may lead to unauthorized data access, information disclosure, or further attacks on the system. The remote attack vector increases risk as it does not require local access.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance breaches if sensitive data is accessed due to the flaw, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Update Drogon to a version beyond 1.9.13-1 or 10.0-beta.3 to address the path traversal flaw in StaticFileRouter::route. If an update is unavailable, restrict network access to the vulnerable component or disable it until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart