CVE-2026-45728
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Algernon before 1.17.7, when invoked with a single file, debug mode exposes the full path and contents of the source file in error responses. Any client can trigger an error and obtain the source code.
Risk Assessment
Source code disclosure can allow an attacker to find other vulnerabilities and steal sensitive data.
Recommendation
Update Algernon to version 1.17.7 or later.
Other vulnerabilities in Algernon
See all- CVE-2026-52792High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.
- CVE-2026-45721Critical
Algernon before version 1.17.7 has a vulnerability in the DirPage function that, when a directory without an index file is requested, searches parent directories (past the configured server root) for a handler.lua file. The found file is executed with full access to the Algernon API, allowing unauthenticated remote code execution.
- CVE-2026-48126High
Algernon before version 1.17.8, when started with --domain (or --letsencrypt), resolves the served directory by joining the configured --dir with the client-supplied Host header without validation, allowing attackers to read arbitrary files, list directories, and execute server-side Lua code.
- CVE-2026-46431Medium
Algernon prior to version 1.17.7 has a vulnerability in the SSE event server where the Access-Control-Allow-Origin header is hardcoded to '*', allowing third-party pages to read the filename stream via JavaScript.
- CVE-2026-46430Medium
The Algernon web server before version 1.17.7 bound the SSE event server to 0.0.0.0:5553 by default on Linux/macOS, allowing external access. This vulnerability is fixed in version 1.17.7.
- CVE-2026-43982High
Algernon before version 1.17.6 contains a vulnerability in the uploadedFileSaveIn() function in lua/upload/upload.go, which uses filepath.Join() with a caller-supplied directory without boundary checking after joining, allowing file writes outside the server's document root.
- CVE-2026-43981High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.6, has a vulnerability in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is not goroutine-safe, concurrent requests race on the shared state, causing Lua VM corruption.
Original NVD description (English source)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.