CVE-2026-53779

HIGH EPSS 32.6%
Published Jun 22, 20261w ago · Modified Jun 23, 20266d ago
8.7 CVSS 4.0
High
Find Similar
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 6d ago

Description

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.

CVSS Details

Base Score
8.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
32.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 3

  • github.com https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0
  • github.com https://github.com/webp-sh/webp_server_go/pull/451
  • vulncheck.com https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.