CVE-2026-43982
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Algernon before version 1.17.6 contains a vulnerability in the uploadedFileSaveIn() function in lua/upload/upload.go, which uses filepath.Join() with a caller-supplied directory without boundary checking after joining, allowing file writes outside the server's document root.
Risk Assessment
An attacker can upload a file to an arbitrary location on the filesystem, potentially leading to code execution or modification of critical files.
Recommendation
Update Algernon to version 1.17.6 or later.
Other vulnerabilities in Algernon
See all- CVE-2026-52792High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.
- CVE-2026-45721Critical
Algernon before version 1.17.7 has a vulnerability in the DirPage function that, when a directory without an index file is requested, searches parent directories (past the configured server root) for a handler.lua file. The found file is executed with full access to the Algernon API, allowing unauthenticated remote code execution.
- CVE-2026-48126High
Algernon before version 1.17.8, when started with --domain (or --letsencrypt), resolves the served directory by joining the configured --dir with the client-supplied Host header without validation, allowing attackers to read arbitrary files, list directories, and execute server-side Lua code.
- CVE-2026-46431Medium
Algernon prior to version 1.17.7 has a vulnerability in the SSE event server where the Access-Control-Allow-Origin header is hardcoded to '*', allowing third-party pages to read the filename stream via JavaScript.
- CVE-2026-46430Medium
The Algernon web server before version 1.17.7 bound the SSE event server to 0.0.0.0:5553 by default on Linux/macOS, allowing external access. This vulnerability is fixed in version 1.17.7.
- CVE-2026-45728High
In Algernon before 1.17.7, when invoked with a single file, debug mode exposes the full path and contents of the source file in error responses. Any client can trigger an error and obtain the source code.
- CVE-2026-43981High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.6, has a vulnerability in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is not goroutine-safe, concurrent requests race on the shared state, causing Lua VM corruption.
Original NVD description (English source)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.