Remote Code Execution in Algernon Web Server for Windows

CVE-2026-52792

What is CVE-2026-52792?

Algernon, a self-contained pure-Go web server, prior to version 1.17.9 on Windows, has a vulnerability where it fails to properly handle file extensions that may contain NTFS-specific suffixes. An attacker can exploit this by crafting requests that append these suffixes to certain script files, leading the server to expose raw script code. This exposure can reveal sensitive data such as database credentials and API keys. The issue arises because the server does not properly validate the requested files, allowing for unauthorized access to sensitive information. The vulnerability is not present on Linux or macOS systems and has been resolved in the latest version.

References