PT-2026-137186

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22 Description An issue exists in the mg path is sane function within src/util.c where the system reads path.buf1 without verifying that path.len is at least two bytes, and reads s2 when only two bytes remain...

PT-2026-85161

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG ENABLE DIRLIST and persuade a user to visit it. The mg http serve dir and listdir path in src/http.c places the decoded request URI int...