CVE-2026-68548

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes /admin, /repo, /data with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On...

CVE-2026-68548 Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate

Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes /admin, /repo, /data with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On...

CVE-2025-65754

CVE-2025-65754 : Stored XSS in Algernon 1.17.4 Description Algernon v1.17.4 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload into a filename. Affected Project : Algernon - 1.17.4 Project maintainer : Alexander F. Rødseth...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

EUVD-2026-62506

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

CVE-2026-52792: Improper Handling of Windows ::DATA Alternate Data Stream

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

SUSE CVE-2026-45721

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories - past the configured server root - looking for a file named handler.lua to execute a...

SUSE CVE-2026-45728

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, which on any Lua or template error respon...

SUSE CVE-2026-46430

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort"", ":5553" resolves to ":5553"...

SUSE CVE-2026-46431

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient ...

SUSE CVE-2026-48126

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain or --letsencrypt, which silently turns on --domain at engine/flags.go:372, the request handler resolves the served directory by joining the configured --dir with the value of the...

GO-2026-5903 Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename in github.com/xyproto/algernon...

CVE-2026-52792

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:07+00:00| published-proof-of-concept| https://github.com/xyproto/algernon/security/advisories/GHSA-mm6c-5j6x-hq8m...

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

GHSA-MM6C-5J6X-HQ8M Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

PT-2026-55477

Name of the Vulnerable Software and Affected Versions Algernon version 1.17.8 Description On Windows hosts using the NTFS filesystem, an unauthenticated client can retrieve the raw source code of server-side scripts such as .lua, .tl, .po2, .amber, or .frm located on public paths. This occurs...