Cpe:2.3:a:algernon:algernon:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aalgernonalgernon/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 22:52:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAlgernon: Unauthenticated path traversal authorization bypass (CVE-2026-68548)https://feed.craftedsignal.io/briefs/2026-11-algernon-path-traversal-cve-2026-68548/Thu, 12 Nov 2026 22:52:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-algernon-path-traversal-cve-2026-68548/Algernon web server uses case-sensitive authorization checks that can be bypassed on case-insensitive filesystems, allowing unauthorized access to protected paths.Algernon is a self-contained Go web server that uses case-sensitive string matching for URL-prefix authorization gates. On case-insensitive filesystems such as Windows NTFS and macOS APFS/HFS+, a request using mixed-case characters can evade these checks and resolve to protected directories on the filesystem.

Impact

This vulnerability allows an unauthenticated bypass of authorization boundaries for the /admin, /repo, and /data paths, enabling unauthorized reading or execution of protected content.

Recommendation

Upgrade the Algernon web server to version 1.17.10, where this issue has been addressed.

]]>criticaladvisory