CVE-2026-48126
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Algernon before version 1.17.8, when started with --domain (or --letsencrypt), resolves the served directory by joining the configured --dir with the client-supplied Host header without validation, allowing attackers to read arbitrary files, list directories, and execute server-side Lua code.
Risk Assessment
An unauthenticated attacker can access files outside the server's document root, including configuration files and Lua scripts, potentially leading to full server compromise.
Recommendation
Update Algernon to version 1.17.8 or later.
Other vulnerabilities in Algernon
See all- CVE-2026-52792High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.
- CVE-2026-45721Critical
Algernon before version 1.17.7 has a vulnerability in the DirPage function that, when a directory without an index file is requested, searches parent directories (past the configured server root) for a handler.lua file. The found file is executed with full access to the Algernon API, allowing unauthenticated remote code execution.
- CVE-2026-46431Medium
Algernon prior to version 1.17.7 has a vulnerability in the SSE event server where the Access-Control-Allow-Origin header is hardcoded to '*', allowing third-party pages to read the filename stream via JavaScript.
- CVE-2026-46430Medium
The Algernon web server before version 1.17.7 bound the SSE event server to 0.0.0.0:5553 by default on Linux/macOS, allowing external access. This vulnerability is fixed in version 1.17.7.
- CVE-2026-45728High
In Algernon before 1.17.7, when invoked with a single file, debug mode exposes the full path and contents of the source file in error responses. Any client can trigger an error and obtain the source code.
- CVE-2026-43982High
Algernon before version 1.17.6 contains a vulnerability in the uploadedFileSaveIn() function in lua/upload/upload.go, which uses filepath.Join() with a caller-supplied directory without boundary checking after joining, allowing file writes outside the server's document root.
- CVE-2026-43981High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.6, has a vulnerability in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is not goroutine-safe, concurrent requests race on the shared state, causing Lua VM corruption.
Original NVD description (English source)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.