Executive brief
Algernon is a standalone web server and application engine. A vulnerability in how the server searches for configuration files allows it to execute scripts found outside of the intended web directory. If an attacker or another process can place a specific script file in a parent directory on the server's host, they can achieve full remote code execution and gain complete control over the server and its data without needing to log in.
Technical details
The vulnerability exists in the 'DirPage' function within 'engine/dirhandler.go'. When a requested URL resolves to a directory without an index file, the server performs an unbounded upward search (up to 100 iterations) for a file named 'handler.lua'. Because the loop does not stop at the configured server root, it can reach the filesystem root (/ or drive letter). If such a file is found, it is executed in a Lua interpreter with full access to the Algernon API, including 'os.execute' and 'io.popen'. This occurs before authentication checks are finalized, allowing an unauthenticated remote attacker to trigger the execution of a malicious script if they can place it in any parent directory of the web root.
Affected products
- xyproto Algernon < 1.17.7
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE-2026-45721 published to NVD
- 2026-05-26: patched: Fixed in version 1.17.7