CVE-2026-16653
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.
Risk Assessment
A remote attacker can read arbitrary files on the server, including configuration files and credentials, potentially leading to sensitive information disclosure.
Recommendation
Update facil.io to a patched version or apply a workaround. Restrict access to the public folder.
Other vulnerabilities in facil.io
See all- CVE-2026-41146High
facil.io prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0 has an infinite loop vulnerability in `fio_json_parse` when encountering a nested JSON value starting with 'i' or 'I'. The process spins in user space and pegs one CPU core at ~100% instead of returning a parse error. Because `iodine` vendors the same parser code, it is also affected.
- CVE-2026-66731High
A denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6 in the HTTP/1.1 chunked transfer encoding parser allows unauthenticated remote attackers to crash the server by sending a negative chunk size value, causing memory corruption and a fault.
- CVE-2026-66730High
A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.
- CVE-2026-66729High
facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.
- CVE-2026-16632High
In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.
Original NVD description (English source)
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.