# CVE-2026-43982: xyproto Algernon path traversal in uploadedFileSaveIn

Source: https://junglewise.ai/threats/cve-2026-43982-xyproto-algernon-path-traversal-in-uploadedfilesavein  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-43982 · Severity: info · CVSS 8.7 · Published 2026-05-26

Algernon is a standalone web server used to host websites and handle file uploads. A security flaw allows an attacker to bypass directory restrictions and save uploaded files to unauthorized locations on the server's hard drive. Depending on how the server is configured, this could allow an attacker to overwrite system files or place malicious files in sensitive folders, potentially compromising the entire server.

Technologies: [Xyproto Algernon](https://junglewise.ai/threats/technologies/algernon). Vendors: [Xyproto](https://junglewise.ai/threats/vendors/xyproto).

## Quick answers

**Is CVE-2026-43982 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43982 being exploited in the wild.

**How severe is CVE-2026-43982?** Informational severity, with a CVSS score of 8.7, published 26 May 2026.

**Which products and versions are affected?** Xyproto Algernon < 1.17.6.

**Is there a fix for CVE-2026-43982?** A patch was published on 2026-05-26: Fix released in version 1.17.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43982 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-43982?** Check whether you run Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the `uploadedFileSaveIn()` function within `lua/upload/upload.go`. The application uses `filepath.Join()` to combine a user-supplied directory path with a filename but fails to validate that the resulting path remains within the intended web root or upload directory. By using 'dot-dot-slash' (`../`) sequences, a remote attacker can escape the restricted directory and write files to arbitrary locations on the filesystem. The impact is heightened if the server is running with high privileges (e.g., root), though it can be mitigated by systemd sandboxing. The issue is resolved in version 1.17.6 by implementing proper boundary checks.

## Affected products

- xyproto Algernon < 1.17.6

## Timeline

- 2026-04-19: disclosed: Initial disclosure to maintainer
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: patched: Fix released in version 1.17.6

## References

- [https://github.com/xyproto/algernon/issues/172](https://github.com/xyproto/algernon/issues/172)
- [https://github.com/xyproto/algernon/security/advisories/GHSA-2j2c-pv62-mmcp](https://github.com/xyproto/algernon/security/advisories/GHSA-2j2c-pv62-mmcp)

## Related threats

- [Algernon URL-prefix authorization bypass on case-insensitive filesystems](https://junglewise.ai/threats/cve-2026-68548-algernon-is-a-small-self-contained-pure-go-web-server-prior-to)
- [xyproto Algernon source disclosure via NTFS filename manipulation](https://junglewise.ai/threats/cve-2026-52792-xyproto-algernon-source-disclosure-via-ntfs-filename-manipulation)
- [xyproto Algernon path traversal and RCE via Host header](https://junglewise.ai/threats/cve-2026-48126-xyproto-algernon-path-traversal-and-rce-via-host-header)
- [xyproto Algernon permissive CORS policy in SSE event server](https://junglewise.ai/threats/cve-2026-46431-xyproto-algernon-permissive-cors-policy-in-sse-event-server)
- [xyproto Algernon information disclosure in single-file mode](https://junglewise.ai/threats/cve-2026-45728-xyproto-algernon-information-disclosure-in-single-file-mode)