The vulnerability in the Algernon web server allows an attacker to achieve remote code execution by placing a handler.lua file in any directory above the server root. The server’s DirPage function traverses up to 100 ancestor directories looking for that file before applying permission checks, so an attacker who can write to any parent directory can cause the file to be loaded into the Lua interpreter. The interpreter has full access to the server’s API, including system commands and database connections, which means the attacker can run arbitrary code on the host with the privileges of the server process. This capability is exercised before any authentication is required, so an unauthenticated user can trigger the exploit with a single GET request to a directory lacking an index file. The impact is pre‑authenticated remote code execution affecting confidentiality, integrity, and availability.

This issue affects the xyproto:algernon web server, specifically all releases older than version 1.17.7. The problem was present in every version before that point, and the fix was introduced in 1.17.7. System administrators should verify the vendor version of each deployed instance and plan an upgrade for any instance running 1.17.6 or earlier.

The CVSS score of 9 denotes critical severity. EPSS information is not provided, so the current likelihood of exploitation cannot be quantified from OpenSSF data, but the vulnerability is listed as not in the CISA KEV catalog. The exploit is trivial from a filesystem perspective: any account that can write to a directory above the configured root can create the handler.lua file, and the next HTTP request to an unindexed directory will trigger the walk and execution. Because the lookup occurs before the permission system is consulted, authentication is not required, giving attackers broad opportunity. The attack vector is a local or remote process capable of writing to the server filesystem, most commonly an attacker who has compromised the server or gained write access via another vulnerability.