Algernon is a small self‑contained pure‑Go web server. Prior to version 1.17.9, on Windows it selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS‑equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of these suffixes to a public server‑side script that uses the .lua, .tl, .po2, .amber, or .frm extensions. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient; while NTFS resolves the alias to the underlying script, the server returns the raw script source and can expose database credentials, API keys, and the SetCookieSecret value, potentially allowing forged session cookies. Linux and macOS hosts are not affected. The issue is fixed in version 1.17.9.

The vulnerability affects the xyproto Algernon web server on Windows platforms running any version older than v1.17.9. Linux and macOS hosts are not impacted, and the issue was fixed in release v1.17.9.

The CVSS score of 8.7 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this remotely over the network without authentication by requesting the aliased URL, which triggers NTFS to resolve the alias and returns the raw script source. The exposure is limited to Windows servers running Algernon prior to v1.17.9, and successful exploitation requires publicly accessible script files with .lua, .tl, .po2, .amber, or .frm extensions; the leaked code may reveal database credentials, API keys, and the SetCookieSecret value, potentially enabling forged session cookies.