SUSE CVE-2026-45721

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories - past the configured server root - looking for a file named handler.lua to execute a...

CVE-2026-45721

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

Path Traversal

github.com/xyproto/algernon is vulnerable to Path Traversal. The vulnerability is due to DirPage traversing parent directories beyond the configured server root while searching for a handler.lua file, which allows an attacker who can place a malicious handler.lua in an ancestor directory to achie...

CVE-2026-45721

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

CVE-2026-45721 Algernon: handler.lua discovery walks parent directories above the server root

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

CVE-2026-45721

CVE-2026-45721 (Algernon) describes a pre-auth remote code execution in Algernon web server prior to version 1.17.7. When a request targets a directory without an index, DirPage behavior walks upward through parent directories past the configured server root in search of a file named handler.lua....

EUVD-2026-31867

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

CVE-2026-45721 Algernon: handler.lua discovery walks parent directories above the server root

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

CVE-2026-45721 Algernon: handler.lua discovery walks parent directories above the server root

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute a...

Algernon: handler.lua discovery walks parent directories above the server root

Summary When Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for a file named handler.lua to execute as the request handler. The loop terminates only after 100 ancest...