Is CVE-2026-48126 actively exploited?

No active exploitation of CVE-2026-48126 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-48126 be exploited remotely?

Yes. CVE-2026-48126 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-48126?

CVE-2026-48126 has a CVSS score of 8.2 (HIGH).

HOME VULNERABILITIESCVE-2026-48126

HIGH

CVE-2026-48126

CWE-22Published: May 26, 2026· Updated: May 26, 2026

8.2

CVSS v3.1

Official Description

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.

NVD Source

Technical Analysis

CVE-2026-48126 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 8.2.