CVE-2026-52792
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.
Risk Assessment
The risk involves potential disclosure of sensitive data such as passwords and keys, and potential session forgery, which could compromise application and data security.
Recommendation
It is recommended to update Algernon to version 1.17.9 or later, which includes the fix.
Other vulnerabilities in Algernon
See all- CVE-2026-45721Critical
Algernon before version 1.17.7 has a vulnerability in the DirPage function that, when a directory without an index file is requested, searches parent directories (past the configured server root) for a handler.lua file. The found file is executed with full access to the Algernon API, allowing unauthenticated remote code execution.
- CVE-2026-48126High
Algernon before version 1.17.8, when started with --domain (or --letsencrypt), resolves the served directory by joining the configured --dir with the client-supplied Host header without validation, allowing attackers to read arbitrary files, list directories, and execute server-side Lua code.
- CVE-2026-46431Medium
Algernon prior to version 1.17.7 has a vulnerability in the SSE event server where the Access-Control-Allow-Origin header is hardcoded to '*', allowing third-party pages to read the filename stream via JavaScript.
- CVE-2026-46430Medium
The Algernon web server before version 1.17.7 bound the SSE event server to 0.0.0.0:5553 by default on Linux/macOS, allowing external access. This vulnerability is fixed in version 1.17.7.
- CVE-2026-45728High
In Algernon before 1.17.7, when invoked with a single file, debug mode exposes the full path and contents of the source file in error responses. Any client can trigger an error and obtain the source code.
- CVE-2026-43982High
Algernon before version 1.17.6 contains a vulnerability in the uploadedFileSaveIn() function in lua/upload/upload.go, which uses filepath.Join() with a caller-supplied directory without boundary checking after joining, allowing file writes outside the server's document root.
- CVE-2026-43981High
Algernon, a small self-contained pure-Go web server, prior to version 1.17.6, has a vulnerability in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is not goroutine-safe, concurrent requests race on the shared state, causing Lua VM corruption.
Original NVD description (English source)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS