Executive brief
Algernon is a standalone web server used to host websites and handle file uploads. A security flaw allows an attacker to bypass directory restrictions and save uploaded files to unauthorized locations on the server's hard drive. Depending on how the server is configured, this could allow an attacker to overwrite system files or place malicious files in sensitive folders, potentially compromising the entire server.
Technical details
A path traversal vulnerability exists in the `uploadedFileSaveIn()` function within `lua/upload/upload.go`. The application uses `filepath.Join()` to combine a user-supplied directory path with a filename but fails to validate that the resulting path remains within the intended web root or upload directory. By using 'dot-dot-slash' (`../`) sequences, a remote attacker can escape the restricted directory and write files to arbitrary locations on the filesystem. The impact is heightened if the server is running with high privileges (e.g., root), though it can be mitigated by systemd sandboxing. The issue is resolved in version 1.17.6 by implementing proper boundary checks.
Affected products
- xyproto Algernon < 1.17.6
Timeline
- 2026-04-19: disclosed: Initial disclosure to maintainer
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: patched: Fix released in version 1.17.6