CVE-2026-48126: xyproto Algernon path traversal and RCE via Host header

Executive brief

Algernon is a web server and application engine. A vulnerability in how it handles web requests allows an attacker to bypass security boundaries and access files outside of the intended web folder. This could lead to the theft of sensitive configuration files or, in some cases, allow the attacker to run malicious commands on the server.

Technical details

A path traversal vulnerability exists in Algernon's request handler when the `--domain` or `--letsencrypt` flags are enabled. The application uses `filepath.Join` to combine the document root with the client-provided `Host` header without validation. An attacker can provide a `Host: ..` header to traverse to the parent directory of the document root. This allows for arbitrary file disclosure, directory listing, and remote code execution if the attacker can trigger the execution of `.lua` files located in the parent directory. The issue is fixed in version 1.17.8.

Affected products

• xyproto algernon <= 1.17.7

Timeline

• 2026-05-24: disclosed
• 2026-05-26: advisory: NVD publication
• 2026-06-23: patched: GitHub Advisory published and reviewed

References

• https://api.github.com/users/fg0x0
• https://github.com/fg0x0
• https://api.github.com/users/fg0x0/gists%7B/gist_id%7D
• https://api.github.com/users/fg0x0/repos
• https://avatars.githubusercontent.com/u/35772301?v=4
• https://api.github.com/users/fg0x0/events%7B/privacy%7D