Local File Read Vulnerability in BIRD Looking Glass by Xddxdd
CVE-2026-63644

7.5HIGH

Key Information:

Vendor

Xddxdd

Status
Bird-lg-go
Vendor
CVE Published:
9 November 2026

What is CVE-2026-63644?

The bird-lg-go application, a BIRD looking glass implemented in Go, contains a vulnerability due to unsanitized input paths that enable an attacker to read arbitrary local files. This flaw allows unauthenticated remote attackers to access sensitive information, such as /etc/shadow and /root/.bash_history, potentially compromising system security. Version 1.4.7 addresses this issue and should be installed to ensure the safety of the application.

Affected Version(s)

bird-lg-go < 1.4.7

References

https://github.com/xddxdd/bird-lg-go/security/advisories/...
x_refsource_CONFIRM
https://github.com/xddxdd/bird-lg-go/commit/74762e4be0d5f...
x_refsource_MISC
https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.7
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.