CVE-2026-53779
Last modified
CVE-2026-53779 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-53779?
How severe is CVE-2026-53779?
How do I fix CVE-2026-53779?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-53765Chrome DevTools for agents (chrome-devtools-mcp) lets your c…6.1
- CVE-2026-53766Chrome DevTools for agents (chrome-devtools-mcp) lets your c…6.1
- CVE-2026-5377GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
- CVE-2026-53776Perry before 0.5.1166 contains a JWT validation vulnerabilit…9.3
- CVE-2026-53777Perry before 0.5.1159 contains a path traversal vulnerabilit…8.6
- CVE-2026-53778Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-5378An issue that allowed administrators to create and update us…6.8
- CVE-2026-53780Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-53781Summarize before 0.17.0 contains a resource exhaustion vulne…5.3
- CVE-2026-53782Summarize before 0.17.0 contains a server-side request forge…7.4
- CVE-2026-53787Amasty Order Attributes for Magento 2 before version 4.0.0 c…9.8
- CVE-2026-5379An issue that allowed MCP agents to access certificate infor…3
Are you affected by CVE-2026-53779?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST