Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir_CVE-2026-48126

{
    "lastseen": "",
    "description": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory \u2014 arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.",
    "published": "2026-05-26T16:44:09.104Z",
    "modified": "2026-05-26T17:27:56.507Z",
    "type": "cve",
    "title": "Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir",
    "source": "GitHub_M",
    "references": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv",
    "id": "CVE-2026-48126",
    "bulletinFamily": "",
    "cwe": [
        "CWE-22",
        "CWE-23",
        "CWE-644"
    ],
    "cvelist": null,
    "sourceData": "xyproto algernon < 1.17.8",
    "sourceHref": "",
    "cvss": {
        "score": 8.2,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "algernon",
    "version": "< 1.17.8",
    "vendor": "xyproto",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}