TI-2026-33460 Aliases CVE-2026-45721 GHSA-xwcr-wm99-g9jc

Algernon: handler.lua discovery walks parent directories above the server root

HIGH 74CWE-20Published 2026-05-26 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution, Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-426 and CWE-552.

Summary

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancestor steps or when filepath.Dir returns ., so on any absolute server-root path the search reaches the filesystem root (/ on Unix, drive letter on Windows). The first handler.lua it finds is loaded into the Lua interpreter with the full Algernon API exposed — including run3(), httpclient, os.execute, io.popen, PQ, MSSQL, raw filesystem access, and the userstate database. Any process that can write handler.lua anywhere in a parent directory of the server root obtains pre-authenticated remote code execution on the next HTTP request. This is reachable without authentication — the lookup happens before the permission check returns a hit (the perm system only gates URL prefixes, not the handler-resolution step), and any URL pointing at a directory without an index triggers the walk. On a fresh stock Algernon install the request GET / is enough. This vulnerability is fixed in 1.17.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00437 38th percentileScored 2026-11-07

Fix Fixed algernon (xyproto): 1.17.7github.com/xyproto/algernon (Go): 1.17.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
xyproto	algernon	before 1.17.7	1.17.7	Patch available	CNA
—	github.com/xyproto/algernon (Go)	before 1.17.7	1.17.7	Patch available	GHSA-xwcr-wm99-g9jc

algernon Vendorxyproto Affected before 1.17.7 Fixed in 1.17.7 Patch available CNA
github.com/xyproto/algernon (Go) Vendor— Affected before 1.17.7 Fixed in 1.17.7 Patch available GHSA-xwcr-wm99-g9jc

Remediation

Fix · CNA algernon (xyproto) Fixed in 1.17.7
Fix · GHSA-xwcr-wm99-g9jc github.com/xyproto/algernon (Go) Fixed in 1.17.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45721
2026-10-03 Alias added: GHSA-xwcr-wm99-g9jc
2026-10-25 EPSS moved to the below the 50th percentile

References

Other 2

TI-2026-37902 Algernon: Server-side script source disclosure on Windows via NTFS filename CVSS 4.0HIGH 8.7
TI-2026-35564 Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir CVSS 3.1HIGH 8.2
TI-2026-33466 Algernon: Single-file mode unconditionally enables debug mode CVSS 3.1HIGH 7.5
TI-2026-34142 Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * CVSS 3.1MEDIUM 4.3
TI-2026-34141 Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS CVSS 3.1MEDIUM 4.3
TI-2026-32026 Algernon: Path traversal file write via savein() CVSS 4.0HIGH 8.7

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences