Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read. An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files. This issue affects wisp: from 2.1.1 before 2.2.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-10 | 1 | Disclosure1 |
| 2026-05-27 | 1 | General1 |
🔴 Wisp, Path Traversal, #CVE-2026-28807 (High) https://dailycve.com/wisp-path-traversal-cve-2026-28807-high/
Post summary
A concise notice of a high‑severity path traversal vulnerability (CVE‑2026‑28807) affecting Wisp, with a hyperlink to a DailyCVE article for details.
CVE-2026-28807 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path tr… https://www.cve.org/CVERecord?id=CVE-2026-28807
Post summary
The post announces CVE‑2026‑28807, describing a path traversal vulnerability in gleam‑wisp that permits arbitrary file reads, with no additional exploit, patch, or activity details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gleam-wisp | wisp | - | - | - |