Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Algernon, Path Traversal leading to Arbitrary File Read & Lua RCE, #CVE-2026-48126 (Critical) -DC-Jun2026-615 https://dailycve.com/algernon-path-traversal-leading-to-arbitrary-file-read-lua-rce-cve-2026-48126-critical-dc-jun2026-615/
Post summary
The text announces a critical CVE-2026-48126 for Algernon, describing path traversal, arbitrary file read and Lua RCE, but providing no PoC, exploit code, or patch information.