Executive brief
Algernon, a web server used for hosting scripts and templates, contains a vulnerability that automatically enables debug mode when serving a single file. When an error occurs in a script, the server responds with a 'PrettyError' page that reveals the full server-side source code and the absolute file path on the server's disk. This allows any remote user to view sensitive application logic and internal file structures without authorization.
Technical details
In Algernon versions prior to 1.17.7, invoking the server with a single file path (singleFileMode) causes 'debugMode' to be forcibly enabled. This activation occurs even if the '--prod' flag is used, as the single-file logic overrides production hardening settings for various file extensions (e.g., .po2, .amber, .tmpl). When 'debugMode' is active, the 'PrettyError' renderer handles Lua or template errors by returning an HTTP 200 OK response containing the absolute path of the file, the complete byte contents of the source file (HTML-escaped), and the specific parser error text. An unauthenticated remote attacker can trigger these errors to exfiltrate the server-side source code of the application and sibling data files. The issue is fixed in version 1.17.7.
Affected products
- xyproto Algernon < 1.17.7
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD