CVE-2026-53779

WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows

Published Jun 22, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.

Analysis

Technical impact

WebP Server Go versions prior to 0.15.0 contain a path traversal flaw on Windows that allows unauthenticated attackers to read arbitrary files outside the configured image directory. The vulnerability stems from the server’s path handling, which accepts percent‑encoded backslashes (%5C) and does not correctly normalize them against Windows file system APIs that treat backslashes and forward slashes identically. As a result, attackers can bypass the path.Clean() sanitization in handler/router.go and retrieve sensitive files accessible to the server process. The flaw provides a high‑severity risk to confidentiality, with a CVSS score of 8.7.

Affected Systems

Vendors: webp-sh, Product: webp_server_go. Affected versions: all releases older than 0.15.0, notably 0.14.4 and earlier. The vulnerability is tied to Windows deployments where the IMG_PATH setting is used to store image resources.

Risk and Exploitability

The flaw is highly exploitable because it requires only an unauthenticated HTTP request containing a specially crafted URL. While the EPSS score is not available, the lack of mitigation and the broad access to files elevate the risk. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS score indicates significant potential impact. Attackers can exploit the path discrepancy by sending requests with homographs of backslashes to traverse directories and read any host files the web server process can access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

webp-sh

webp_server_go

affected

Version	Status	Constraints
`0`	affected	< 0.15.0

No data.

Vendor Product Versions

Webp

Webp Server Go

Version	Status	Scheme	Platform
`[0,0.15.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade webp-server-go to version 0.15.0 or later, which removes the backslash handling flaw.
If an upgrade is not immediately possible, configure the server or reverse proxy to reject or normalize URLs containing percent‑encoded backslashes, effectively blocking traversal attempts.
Set a restrictive IMG_PATH that points to a dedicated directory with minimal permissions, and enforce least‑privilege ownership on the file system so that the server process cannot read sensitive data.

Generated by OpenCVE AI on June 22, 2026 at 19:20 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.587% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0
https://github.com/webp-sh/webp_server_go/pull/451
https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows

History

Jul 14, 2026 9:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:webp:webp_server_go::::::::

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Webp Webp webp Server Go
Vendors & Products		Webp Webp webp Server Go

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 6:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.
Title		WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows
Weaknesses		CWE-22
References		https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0 https://github.com/webp-sh/webp_server_go/pull/451 https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`