CVE-2026-48126HIGH 8.2EPSS p25.1%
CVE-2026-48126CVE-2026-48126
Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.
Scoring
| CVSS 3.1 | 8.2 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| EPSS | 0.34% probability of exploitation · percentile 25.1% · 2026-06-18T12:00:27Z |
| Published | 2026-05-26 |
| Last modified | 2026-05-26 |
Underlying weaknesses· 3
References
3
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')cwe-22 | 0% | live |
| Weakness | Relative Path Traversalcwe-23 | 0% | live |
| Weakness | Improper Neutralization of HTTP Headers for Scripting Syntaxcwe-644 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.