CVE-2026-53779
WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows
Description
WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.
INFO
Published Date :
June 22, 2026, 7:17 p.m.
Last Modified :
July 14, 2026, 10:17 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update WebP Server Go to the latest version.
- Ensure path sanitization correctly handles Windows path separators.
- Restrict access to sensitive files.
- Apply security patches promptly.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53779.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53779 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53779
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53779 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53779 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://github.com/webp-sh/webp_server_go', 'vendor': 'webp-sh', 'product': 'webp_server_go', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '0.15.0', 'versionType': 'semver'}], 'defaultStatus': 'affected'}] [{'repo': 'https://github.com/webp-sh/webp_server_go', 'vendor': 'webp-sh', 'product': 'webp_server_go', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '0.15.0', 'versionType': 'semver'}], 'packageURL': 'pkg:github/webp-sh/webp_server_go', 'defaultStatus': 'affected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 23, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53779', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-23T14:12:03.904360Z'} -
New CVE Received by [email protected]
Jun. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/webp-sh/webp_server_go', 'vendor': 'webp-sh', 'product': 'webp_server_go', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '0.15.0', 'versionType': 'semver'}], 'defaultStatus': 'affected'}] Added Description WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Added CWE CWE-22 Added Reference https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0 Added Reference https://github.com/webp-sh/webp_server_go/pull/451 Added Reference https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows