CVE-2026-45721

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45721", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T05:51:48.666Z", "datePublished": "2026-05-26T16:34:49.985Z", "dateUpdated": "2026-05-26T17:15:34.450Z"}, "containers": {"cna": {"title": "Algernon: handler.lua discovery walks parent directories above the server root", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-552", "lang": "en", "description": "CWE-552: Files or Directories Accessible to External Parties", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc"}], "affected": [{"vendor": "xyproto", "product": "algernon", "versions": [{"version": "< 1.17.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:34:49.985Z"}, "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories \u2014 past the configured server root \u2014 looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancestor steps or when filepath.Dir returns ., so on any absolute server-root path the search reaches the filesystem root (/ on Unix, drive letter on Windows). The first handler.lua it finds is loaded into the Lua interpreter with the full Algernon API exposed \u2014 including run3(), httpclient, os.execute, io.popen, PQ, MSSQL, raw filesystem access, and the userstate database. Any process that can write handler.lua anywhere in a parent directory of the server root obtains pre-authenticated remote code execution on the next HTTP request. This is reachable without authentication \u2014 the lookup happens before the permission check returns a hit (the perm system only gates URL prefixes, not the handler-resolution step), and any URL pointing at a directory without an index triggers the walk. On a fresh stock Algernon install the request GET / is enough. This vulnerability is fixed in 1.17.7."}], "source": {"advisory": "GHSA-xwcr-wm99-g9jc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T17:13:14.630410Z", "id": "CVE-2026-45721", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:15:34.450Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45721", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T17:13:14.630410Z"}}}], "references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:13:06.865Z"}}], "cna": {"title": "Algernon: handler.lua discovery walks parent directories above the server root", "source": {"advisory": "GHSA-xwcr-wm99-g9jc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xyproto", "product": "algernon", "versions": [{"status": "affected", "version": "< 1.17.7"}]}], "references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc", "name": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories \u2014 past the configured server root \u2014 looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancestor steps or when filepath.Dir returns ., so on any absolute server-root path the search reaches the filesystem root (/ on Unix, drive letter on Windows). The first handler.lua it finds is loaded into the Lua interpreter with the full Algernon API exposed \u2014 including run3(), httpclient, os.execute, io.popen, PQ, MSSQL, raw filesystem access, and the userstate database. Any process that can write handler.lua anywhere in a parent directory of the server root obtains pre-authenticated remote code execution on the next HTTP request. This is reachable without authentication \u2014 the lookup happens before the permission check returns a hit (the perm system only gates URL prefixes, not the handler-resolution step), and any URL pointing at a directory without an index triggers the walk. On a fresh stock Algernon install the request GET / is enough. This vulnerability is fixed in 1.17.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426: Untrusted Search Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "CWE-552: Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:34:49.985Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45721", "state": "PUBLISHED", "dateUpdated": "2026-05-26T17:15:34.450Z", "dateReserved": "2026-05-13T05:51:48.666Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T16:34:49.985Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "algernon", "vendor": "xyproto", "versions": [{"status": "affected", "version": "< 1.17.7"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories \u2014 past the configured server root \u2014 looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancestor steps or when filepath.Dir returns ., so on any absolute server-root path the search reaches the filesystem root (/ on Unix, drive letter on Windows). The first handler.lua it finds is loaded into the Lua interpreter with the full Algernon API exposed \u2014 including run3(), httpclient, os.execute, io.popen, PQ, MSSQL, raw filesystem access, and the userstate database. Any process that can write handler.lua anywhere in a parent directory of the server root obtains pre-authenticated remote code execution on the next HTTP request. This is reachable without authentication \u2014 the lookup happens before the permission check returns a hit (the perm system only gates URL prefixes, not the handler-resolution step), and any URL pointing at a directory without an index triggers the walk. On a fresh stock Algernon install the request GET / is enough. This vulnerability is fixed in 1.17.7."}, {"lang": "es", "value": "Algernon es un peque\u00f1o servidor web autocontenido y puro-Go. Antes de la versi\u00f3n 1.17.7, cuando se le solicita a Algernon cualquier ruta URL que se resuelva en un directorio sin un archivo de \u00edndice, DirPage asciende a trav\u00e9s de los directorios padre - m\u00e1s all\u00e1 de la ra\u00edz del servidor configurada - buscando un archivo llamado handler.lua para ejecutar como gestor de solicitudes. El bucle termina solo despu\u00e9s de 100 pasos de ancestro o cuando filepath.Dir devuelve ., por lo que en cualquier ruta absoluta de la ra\u00edz del servidor la b\u00fasqueda alcanza la ra\u00edz del sistema de archivos (/ en Unix, letra de unidad en Windows). El primer handler.lua que encuentra se carga en el int\u00e9rprete de Lua con la API completa de Algernon expuesta - incluyendo run3(), httpclient, os.execute, io.popen, PQ, MSSQL, acceso directo al sistema de archivos y la base de datos de estado de usuario. Cualquier proceso que pueda escribir handler.lua en cualquier lugar de un directorio padre de la ra\u00edz del servidor obtiene ejecuci\u00f3n remota de c\u00f3digo preautenticada en la siguiente solicitud HTTP. Esto es alcanzable sin autenticaci\u00f3n - la b\u00fasqueda ocurre antes de que la verificaci\u00f3n de permisos devuelva un acierto (el sistema de permisos solo restringe los prefijos URL, no el paso de resoluci\u00f3n del gestor), y cualquier URL que apunte a un directorio sin un \u00edndice activa el recorrido. En una instalaci\u00f3n nueva y est\u00e1ndar de Algernon la solicitud GET / es suficiente. Esta vulnerabilidad se corrige en la versi\u00f3n 1.17.7."}], "id": "CVE-2026-45721", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45721", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T17:13:14.630410Z", "version": "2.0.3"}}]}, "published": "2026-05-26T17:16:47.750", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-xwcr-wm99-g9jc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-426"}, {"lang": "en", "value": "CWE-552"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.17.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "algernon", "source": "cna", "vendor": "xyproto"}, "product": "algernon", "vendor": "xyproto"}], "created": "2026-05-26T18:45:13.153926+00:00", "updated": "2026-05-27T10:04:46.856901+00:00", "vendors": ["xyproto", "xyproto$PRODUCT$algernon"]}