# CVE-2026-52792: xyproto Algernon source disclosure via NTFS filename manipulation

Source: https://junglewise.ai/threats/cve-2026-52792-xyproto-algernon-source-disclosure-via-ntfs-filename-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-52792 · Severity: high · CVSS 4 · Published 2026-07-02

Algernon, a web server and application server, is vulnerable to a security flaw on Windows systems that allows unauthorized users to view the raw source code of server-side scripts. By appending specific characters to a web request, an attacker can bypass the normal execution of scripts and instead download the file directly. This can lead to the exposure of sensitive information such as database passwords, API keys, and session secrets, which could be used to take over the application or access private data.

Technologies: [github.com/xyproto/algernon (Go)](https://junglewise.ai/threats/technologies/github-com-xyproto-algernon), [Xyproto Algernon](https://junglewise.ai/threats/technologies/algernon). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Xyproto](https://junglewise.ai/threats/vendors/xyproto).

## Quick answers

**Is CVE-2026-52792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52792 being exploited in the wild.

**How severe is CVE-2026-52792?** High severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** github.com/xyproto/algernon (Go) <= 1.17.8, SEMVER:introduced=0,fixed=1.17.9; Xyproto Algernon <= 1.17.8.

**Is there a fix for CVE-2026-52792?** Yes. github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52792 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52792?** Check whether you run github.com/xyproto/algernon (Go) or Xyproto Algernon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/xyproto/algernon (Go): upgrade to 1.17.9 or later

  ```sh
  go get github.com/xyproto/algernon@v1.17.9
  ```


## Technical details

Algernon fails to properly canonicalize Windows-specific NTFS filename suffixes before determining the file handler. When a request is made for a script (e.g., .lua) with an appended NTFS Alternate Data Stream identifier (::$DATA), a trailing dot, or a trailing space, the `filepath.Ext()` function fails to recognize the file as a script. Consequently, the server bypasses the script execution engine and falls back to a default handler that serves the file as raw bytes. An unauthenticated remote attacker can exploit this to read the source code of any script on a public path, potentially revealing hardcoded credentials or session signing secrets. This vulnerability only affects instances running on Windows with NTFS filesystems.

## Affected products

- xyproto algernon <= 1.17.8

## Identifiers

- CVE-2026-52792
- GHSA-mm6c-5j6x-hq8m
- GO-2026-5903

## Timeline

- 2026-05-29: disclosed
- 2026-07-02: advisory: GitHub Advisory published
- 1.17.9: patched

## References

- [https://api.github.com/users/Dredsen](https://api.github.com/users/Dredsen)
- [https://github.com/Dredsen](https://github.com/Dredsen)
- [https://api.github.com/users/Dredsen/gists%7B/gist_id%7D](https://api.github.com/users/Dredsen/gists%7B/gist_id%7D)
- [https://api.github.com/users/Dredsen/repos](https://api.github.com/users/Dredsen/repos)
- [https://avatars.githubusercontent.com/u/24421368?v=4](https://avatars.githubusercontent.com/u/24421368?v=4)
- [https://api.github.com/users/Dredsen/events%7B/privacy%7D](https://api.github.com/users/Dredsen/events%7B/privacy%7D)

## Related threats

- [Algernon URL-prefix authorization bypass on case-insensitive filesystems](https://junglewise.ai/threats/cve-2026-68548-algernon-is-a-small-self-contained-pure-go-web-server-prior-to)
- [GO-2026-5300 - Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and…](https://junglewise.ai/threats/go-2026-5300-algernon-auto-refresh-sse-event-server-binds-to-all-459dcf1f)
- [xyproto Algernon path traversal and RCE via Host header](https://junglewise.ai/threats/cve-2026-48126-xyproto-algernon-path-traversal-and-rce-via-host-header)
- [xyproto Algernon permissive CORS policy in SSE event server](https://junglewise.ai/threats/cve-2026-46431-xyproto-algernon-permissive-cors-policy-in-sse-event-server)
- [xyproto Algernon information disclosure in single-file mode](https://junglewise.ai/threats/cve-2026-45728-xyproto-algernon-information-disclosure-in-single-file-mode)