{"id":"CVE-2026-53779","title":"WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows","summary":"WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) tha…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"webp-sh","product":"webp_server_go","affected":["webp_server_go < 0.15.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-23T14:12:03.904360Z"},"published":"2026-06-22","updated":"2026-09-24","sourceUpdated":"2026-09-24T14:17:47.007Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53779","references":[{"url":"https://github.com/webp-sh/webp_server_go/pull/451","label":"Pull Request"},{"url":"https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows"}],"tags":["cve.org"],"epss":0.00587,"epssPercentile":0.46819,"ingestedAt":"2026-09-24T15:45:56.728Z","slug":"CVE-2026-53779","body":"## Overview\n\nWebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.\n\n## Affected\n\n- `webp_server_go < 0.15.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}