« Volver al listado

CVE-2026-48126

Estado: AplazadaAlta (8.2)—

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). Host header manipulado permite lectura arbitraria de archivos (T1005) y ejecución de Lua si existen (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Algernon — AlgernonAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-48126",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48126",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T17:27:29.590530Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "xyproto",
          "product": "algernon",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.17.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T17:16:53.360",
  "references": [
    {
      "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/xyproto/algernon/security/advisories/GHSA-jc3j-x6pg-4hmv",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-23"
        },
        {
          "lang": "en",
          "value": "CWE-644"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8."
    },
    {
      "lang": "es",
      "value": "Algernon es un pequeño servidor web autocontenido y puro Go. Antes de la 1.17.8, cuando algernon se inicia con --domain (o --letsencrypt, que activa silenciosamente --domain en engine/flags.go:372), el gestor de solicitudes resuelve el directorio servido uniendo el --dir configurado con el valor del encabezado Host proporcionado por el cliente. La unión se realiza mediante filepath.Join sin validación, por lo que un encabezado Host: .. sube un nivel por encima de la raíz del documento. La resolución de archivos posterior expone entonces todo en ese directorio padre - lectura de archivos arbitraria, listado completo de directorios y, si hay algún archivo .lua presente, ejecución de Lua del lado del servidor. Esta vulnerabilidad se corrige en la versión 1.17.8."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}