Security Advisory

CVE-2026-43982

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-26 16:30:09

Last updated 2026-05-26 17:20:19

Assigner GitHub_M

CVSS score 8.7

State PUBLISHED

Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.

← Browse all CVEs View on cve.org ↗