Is CVE-2026-73255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73255 being exploited in the wild.

How severe is CVE-2026-73255?

Medium severity, with a CVSS score of 6.5, published 20 August 2026.

Is there a fix for CVE-2026-73255?

A patch was published on 2026-06-23: Fix merged in commit a9df523f76f43a38bd53b4232b9cfd4c16869e71 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73255 attacked?

It is attacked with local access.

Am I affected by CVE-2026-73255?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73255: Cesanta Mongoose directory traversal in SSI processing

CVE-2026-73255 · Severity: medium · CVSS 6.5 · Published 2026-08-20

Mongoose is an embedded web server commonly used in IoT devices and embedded systems. When Server-Side Includes (SSI) are enabled, an attacker who can create or modify SSI-enabled files can use directory traversal sequences to read arbitrary files from the system. This allows disclosure of sensitive files (configuration, credentials, source code) that the Mongoose process can access, potentially exposing confidential data.

Quick answers

Is CVE-2026-73255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73255 being exploited in the wild.
How severe is CVE-2026-73255?: Medium severity, with a CVSS score of 6.5, published 20 August 2026.
Which products and versions are affected?: Cesanta Mongoose before 7.22.
Is there a fix for CVE-2026-73255?: A patch was published on 2026-06-23: Fix merged in commit a9df523f76f43a38bd53b4232b9cfd4c16869e71 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73255 attacked?: It is attacked with local access.
Am I affected by CVE-2026-73255?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a directory traversal flaw in the mg_ssi() function within src/ssi.c. When processing SSI #include directives (both file and virtual variants), the function concatenates user-supplied path arguments directly into filesystem paths without validating them through mg_path_is_sane(). This allows an attacker controlling SSI-enabled files to inject traversal sequences (e.g., ../) to escape the intended directory and read files outside the web root. The attack requires MG_ENABLE_SSI to be compiled in and ssi_pattern to be configured; an attacker needs write access to SSI files or the ability to influence their content. The fix was released in version 7.22.

Affected products

Cesanta Mongoose before 7.22

Timeline

2026-06-23: patched: Fix merged in commit a9df523f76f43a38bd53b4232b9cfd4c16869e71
2026-08-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.