CVE-2026-24469

C++ HTTP Server is an HTTP/1.1 server built to handle client connections and serve HTTP requests. Versions 1.0 and below are vulnerable to Path Traversal via the RequestHandler::handleRequest method. This flaw allows an unauthenticated, remote attacker to read arbitrary files from the server's filesystem by crafting a malicious HTTP GET request containing ../ sequences. The application fails to sanitize the filename variable derived from the user-controlled URL path, directly concatenating it to the files_directory base path and enabling traversal outside the intended root. No patch was available at the time of publication.

• CWE-22

• https://github.com/frustratedProton/http-server/security/advisories/GHSA-qp54-6gfq-3gff

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2446The PowerPack for LearnDash WordPress plugin before 1.3.0 do…9.8
• CVE-2026-24464When running in Appliance mode, a directory traversal vulner…6.9
• CVE-2026-24465Stack-based buffer overflow vulnerability exists in ELECOM w…9.8
• CVE-2026-24466Products provided by Oki Electric Industry Co., Ltd. and its…8.4
• CVE-2026-24467OpenAEV is an open source platform allowing organizations to…9.8
• CVE-2026-24468OpenAEV is an open source platform allowing organizations to…5.3
• CVE-2026-2447Heap buffer overflow in libvpx. This vulnerability was fixed…8.8
• CVE-2026-24470Skipper is an HTTP router and reverse proxy for service comp…8.1
• CVE-2026-24471continuwuity is a Matrix homeserver written in Rust. This vu…9.3
• CVE-2026-24472Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24473Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24474Dioxus Components is a shadcn-style component library for th…5.3