Path Traversal Vulnerability in Wisp by Gleam Wisp

CVE-2026-28807

What is CVE-2026-28807?

A vulnerability has been identified in the Wisp application allowing unauthorized access to sensitive files through path traversal. The flaw exists in the wisp.serve_static function, where improper sanitization of input permits an attacker to manipulate encoded paths. Specifically, the percent-encoded sequence %2e%2e is not properly handled, enabling attackers to decode requests and traverse directories. As a result, any file that the application processes can become readable by sending a single HTTP request. This not only includes application source code and configuration files but can also expose secrets and other critical system files. The impacted versions are Wisp from 2.1.1 up to, but not including, 2.2.1.

References