Algernon’s upload handler built on pure Go concatenates a caller‑supplied directory path with the requested filename using filepath.Join. No post‑join validation is performed, so an attacker can supply a directory such as ../../../tmp that resolves to /tmp. This allows the attacker to write arbitrary files outside the web root, potentially exposing sensitive data or enabling further exploitation. The weakness is a classic directory traversal problem (CWE‑22) that compromises integrity of the filesystem and can lead to data leakage or remote code execution if privileged files are overwritten.

The vulnerability affects the xyproto "Algernon" web server for all releases prior to 1.17.6. Users running any 1.17.x version earlier than 1.17.6, or older major releases, are potentially exposed if the upload API is reachable.

The CVSS base score of 8.7 indicates high risk. EPSS data is not available, so the current exploitation probability is uncertain, but the absence from the KEV catalog suggests no known public exploits yet. The attack vector is likely a web‑based file upload endpoint; it requires the adversary to be able to submit a custom directory path, which may be restricted by authentication. Nonetheless, the lack of boundary checks gives an attacker a clear path to write files outside the protected directory.