Directory Traversal and Arbitrary File Read on Algernon Web Server by XYProto

CVE-2026-48126

What is CVE-2026-48126?

The Algernon web server, prior to version 1.17.8, is susceptible to a directory traversal vulnerability when started with the --domain or --letsencrypt flags. This weakness allows an attacker to exploit the server by supplying a crafted Host header that utilizes '..', enabling access to parent directories. Consequently, this results in the potential for arbitrary file reads and full directory listings, which can lead to more severe exploits, including server-side execution of .lua files, compromising the integrity and confidentiality of the server's data.

References