Path Traversal in Xyproto Algernon
CVE-2026-43982
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.
Affected products
- Xyproto Algernon — versions < 1.17.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)