Prior to version 1.17.8, the Algernon web server allows a Host header containing a path traversal sequence to affect the directory resolution performed when the server is run with the --domain or --letsencrypt flags. An attacker can send an HTTP request with a Host header such as Host: .., causing the server to join the configured document root with the supplied value and read files from the parent directory. This flaw permits arbitrary local file disclosure, exhaustive directory listings, and, if any .lua files exist in the parent directory, execution of Lua code on the server. The vulnerability is characterized by CWE-22, CWE-23, and CWE-644, and can lead to remote code execution and compromise of confidentiality, integrity, and availability.

The impacted product is the Algernon web server developed by xyproto, specifically any release earlier than 1.17.8. All versions that support the --domain or --letsencrypt startup options without validating the Host header are vulnerable. Users deploying these older releases should verify their version and apply the patch when available.

The CVSS score of 8.2 indicates a high severity vulnerability, while the EPSS is not available. The issue is not currently listed in CISA’s KEV catalog. An attacker can exploit the flaw simply by sending an HTTP request to a server running a vulnerable version of Algernon. The required conditions are a reachable HTTP port and the server being started with the --domain or --letsencrypt options, both of which are common in production deployments. Successful exploitation can result in reading arbitrary files, listing directory contents, and executing Lua scripts, thereby compromising system integrity.