Skip to content
OpenAdvisories

Vendor

xyproto

9 known vulnerabilities.

Products

algernon 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-68548

    Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate

    Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is lat…

    xyproto algernon
  • Critical 9.0
    CVE-2026-45721

    Algernon: handler.lua discovery walks parent directories above the server root

    Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for…

    xyproto algernon github.com/xyproto/algernon Go