Skip to content
OpenAdvisories

Package · Go

github.com/xyproto/algernon

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-52792

    Algernon: Server-side script source disclosure on Windows via NTFS filename

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unaut…

    xyproto algernon github.com/xyproto/algernon Go
  • High 8.2
    CVE-2026-48126

    Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the config…

    xyproto algernon github.com/xyproto/algernon Go
  • High 7.5
    CVE-2026-45728

    Algernon: Single-file mode unconditionally enables debug mode

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whi…

    xyproto algernon github.com/xyproto/algernon Go