Is CVE-2026-52792 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52792 being exploited in the wild.

How severe is CVE-2026-52792?

High severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

github.com/xyproto/algernon (Go) <= 1.17.8, SEMVER:introduced=0,fixed=1.17.9; Xyproto Algernon <= 1.17.8.

Is there a fix for CVE-2026-52792?

Yes. github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52792 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52792?

Check whether you run github.com/xyproto/algernon (Go) or Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52792: xyproto Algernon source disclosure via NTFS filename manipulation

Q: Is there a fix for CVE-2026-52792?

Yes. github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52792 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52792?

Check whether you run github.com/xyproto/algernon (Go) or Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52792 · Severity: high · CVSS 4 · Published 2026-07-02

Algernon, a web server and application server, is vulnerable to a security flaw on Windows systems that allows unauthorized users to view the raw source code of server-side scripts. By appending specific characters to a web request, an attacker can bypass the normal execution of scripts and instead download the file directly. This can lead to the exposure of sensitive information such as database passwords, API keys, and session secrets, which could be used to take over the application or access private data.

Technologies: github.com/xyproto/algernon (Go), Xyproto Algernon. Vendors: Go, Xyproto.

Quick answers

Is CVE-2026-52792 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52792 being exploited in the wild.
How severe is CVE-2026-52792?: High severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: github.com/xyproto/algernon (Go) <= 1.17.8, SEMVER:introduced=0,fixed=1.17.9; Xyproto Algernon <= 1.17.8.
Is there a fix for CVE-2026-52792?: Yes. github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52792 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52792?: Check whether you run github.com/xyproto/algernon (Go) or Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later
```
go get github.com/xyproto/algernon@v1.17.9
```

Technical details

Algernon fails to properly canonicalize Windows-specific NTFS filename suffixes before determining the file handler. When a request is made for a script (e.g., .lua) with an appended NTFS Alternate Data Stream identifier (::$DATA), a trailing dot, or a trailing space, the `filepath.Ext()` function fails to recognize the file as a script. Consequently, the server bypasses the script execution engine and falls back to a default handler that serves the file as raw bytes. An unauthenticated remote attacker can exploit this to read the source code of any script on a public path, potentially revealing hardcoded credentials or session signing secrets. This vulnerability only affects instances running on Windows with NTFS filesystems.

Affected products

xyproto algernon <= 1.17.8

Identifiers

CVE-2026-52792
GHSA-mm6c-5j6x-hq8m
GO-2026-5903

Timeline

2026-05-29: disclosed
2026-07-02: advisory: GitHub Advisory published
1.17.9: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.