CVE-2026-43982

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6.

• CWE-22

• https://github.com/xyproto/algernon/issues/172
• https://github.com/xyproto/algernon/security/advisories/GHSA-2j2c-pv62-mmcp

Published

May 26, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43977wger is a free, open-source workout and fitness manager. In …7.5
• CVE-2026-43978wger is a free, open-source workout and fitness manager. In …8.1
• CVE-2026-43979Local Deep Research is an AI-powered research assistant for …5
• CVE-2026-4398GitLab has remediated an issue in GitLab EE affecting all ve…5.4
• CVE-2026-43980Malla is a web analyzer for Meshtastic networks based on MQT…6.3
• CVE-2026-43981Algernon is a small self-contained pure-Go web server. Prior…8.2
• CVE-2026-43983Pocket ID is an OIDC provider that allows users to authentic…8.1
• CVE-2026-43984Tautulli is a Python based monitoring and tracking tool for …8.9
• CVE-2026-43985Tautulli is a Python based monitoring and tracking tool for …8.8
• CVE-2026-43986Tautulli is a Python based monitoring and tracking tool for …9.9
• CVE-2026-43988Vanetza is an open-source implementation of the ETSI C-ITS p…7.5
• CVE-2026-43989JunoClaw is an agentic AI platform built on Juno Network. Pr…8.5