CVE-2026-48126

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48126", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:46:58.291Z", "datePublished": "2026-05-26T16:44:09.104Z", "dateUpdated": "2026-05-26T17:27:56.507Z"}, "containers": {"cna": {"title": "Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-23", "lang": "en", "description": "CWE-23: Relative Path Traversal", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-644", "lang": "en", "description": "CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv"}], "affected": [{"vendor": "xyproto", "product": "algernon", "versions": [{"version": "< 1.17.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:44:09.104Z"}, "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory \u2014 arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8."}], "source": {"advisory": "GHSA-jc3j-x6pg-4hmv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T17:27:29.590530Z", "id": "CVE-2026-48126", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:27:56.507Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48126", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T17:27:29.590530Z"}}}], "references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T17:27:11.550Z"}}], "cna": {"title": "Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir", "source": {"advisory": "GHSA-jc3j-x6pg-4hmv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xyproto", "product": "algernon", "versions": [{"status": "affected", "version": "< 1.17.8"}]}], "references": [{"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv", "name": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory \u2014 arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-644", "description": "CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T16:44:09.104Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48126", "state": "PUBLISHED", "dateUpdated": "2026-05-26T17:27:56.507Z", "dateReserved": "2026-05-20T18:46:58.291Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T16:44:09.104Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "algernon", "vendor": "xyproto", "versions": [{"status": "affected", "version": "< 1.17.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory \u2014 arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8."}, {"lang": "es", "value": "Algernon es un peque\u00f1o servidor web autocontenido y puro Go. Antes de la 1.17.8, cuando algernon se inicia con --domain (o --letsencrypt, que activa silenciosamente --domain en engine/flags.go:372), el gestor de solicitudes resuelve el directorio servido uniendo el --dir configurado con el valor del encabezado Host proporcionado por el cliente. La uni\u00f3n se realiza mediante filepath.Join sin validaci\u00f3n, por lo que un encabezado Host: .. sube un nivel por encima de la ra\u00edz del documento. La resoluci\u00f3n de archivos posterior expone entonces todo en ese directorio padre - lectura de archivos arbitraria, listado completo de directorios y, si hay alg\u00fan archivo .lua presente, ejecuci\u00f3n de Lua del lado del servidor. Esta vulnerabilidad se corrige en la versi\u00f3n 1.17.8."}], "id": "CVE-2026-48126", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48126", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T17:27:29.590530Z", "version": "2.0.3"}}]}, "published": "2026-05-26T17:16:53.360", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}, {"lang": "en", "value": "CWE-644"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.17.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "algernon", "source": "cna", "vendor": "xyproto"}, "product": "algernon", "vendor": "xyproto"}], "created": "2026-05-26T18:45:13.152475+00:00", "updated": "2026-05-27T10:04:25.426541+00:00", "vendors": ["xyproto", "xyproto$PRODUCT$algernon"]}