Is CVE-2026-49846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49846 being exploited in the wild.

How severe is CVE-2026-49846?

High severity, with a CVSS score of 7.5, published 11 September 2026.

Is there a fix for CVE-2026-49846?

A patch was published on 2026-06-03: Version 2.0.11 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49846 attacked?

It is attacked over the network.

Am I affected by CVE-2026-49846?

Check whether you run SignalWire Libks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49846: signalwire libks path traversal in HTTP URI parser

CVE-2026-49846 · Severity: high · CVSS 7.5 · Published 2026-09-11

libks is a foundational C library used by SignalWire products to handle HTTP request parsing. A flaw in the URI canonicalization function allows attackers to craft specially-formed HTTP requests with deeply-nested paths that bypass security checks, enabling unauthorized reading of arbitrary files from the server's filesystem. Any SignalWire product or service using libks for HTTP static file serving becomes vulnerable if exposed to untrusted network input.

Vendors: SignalWire.

Quick answers

Is CVE-2026-49846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49846 being exploited in the wild.
How severe is CVE-2026-49846?: High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?: SignalWire Libks < 2.0.11.
Is there a fix for CVE-2026-49846?: A patch was published on 2026-06-03: Version 2.0.11 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49846 attacked?: It is attacked over the network.
Am I affected by CVE-2026-49846?: Check whether you run SignalWire Libks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the clean_uri() function within libks's HTTP request parser (kws.c). The function splits incoming URIs on "/" into a 64-element pointer array for canonicalization, but uses an incorrect buffer size check: it compares the element count against sizeof(argv)—which is the byte size of the pointer array, not the element count—making the rejection logic dead code. When a URI contains more than 64 path segments, ks_separate_string() leaves the unsplit remainder in argv[63]; the canonicalization loop treats this as a literal string and does not process embedded ".." sequences within it. An attacker can submit a GET request with ≥63 padding path segments followed by a traversal payload (e.g., /a/a/.../a/../../../../etc/passwd) to escape the intended document root and read arbitrary files. The attack requires network reachability to a consumer of kws_parse_header() (such as mod_verto's HTTP-static handler in FreeSWITCH) and succeeds whether or not authentication is configured. libks version 2.0.11 and later contain the fix.

Affected products

signalwire libks < 2.0.11

Timeline

2026-06-03: disclosed
2026-06-03: patched: Version 2.0.11 released with fix

References

https://github.com/signalwire/libks/security/advisories/GHSA-684h-wjm9-2p6j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.