CVE-2026-105144
MediumCVSS 5.3Summary
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker may read files outside the intended directory, potentially exposing configuration data or source code. Public availability of the exploit increases the risk.
Recommendation
Upgrade Drogon beyond version 1.9.13-1/10.0-beta.3 or implement path validation in StaticFileRouter. Restrict access to the static file server.
Other vulnerabilities in Drogon
See all- CVE-2026-94144High
A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-94143High
A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS