# CVE-2026-48126

## Summary

- **CVE ID:** CVE-2026-48126
- **Severity:** HIGH
- **CVSS Score:** 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
- **CWE:** CWE-22, CWE-23, CWE-644
- **Published:** May 26, 2026
- **Last Modified:** May 26, 2026

## Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.

## Affected Products

- xyproto — algernon (< 1.17.8)

## References

- [CNA](https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.34%
- **EPSS Percentile:** 26.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._