Executive brief
WebP Server Go is a tool used to convert and serve images in the efficient WebP format to speed up websites. A security flaw in versions running on Windows allows unauthorized individuals to bypass folder restrictions and view any file on the host server. This could lead to the exposure of sensitive system files, configuration data, or other private information stored on the server.
Technical details
A path traversal vulnerability exists in WebP Server Go versions up to 0.14.4 when deployed on Windows operating systems. The issue stems from a discrepancy between Go's 'path.Clean()' function, which only normalizes forward slashes, and the Windows file system API, which treats backslashes and forward slashes interchangeably. An unauthenticated attacker can use percent-encoded backslashes (%5C) in a URL request to bypass sanitization logic in 'handler/router.go'. This allows the attacker to escape the 'IMG_PATH' directory and access any file on the filesystem that the server process has permissions to read. The vulnerability is addressed in version 0.15.0.
Affected products
- webp-sh webp_server_go <= 0.14.4
Timeline
- 2026-06-01: other: Fix requested via pull request
- 2026-06-03: patched: Fix merged into master branch
- 2026-06-22: disclosed: CVE published and advisory released by VulnCheck