---
id: CVE-2026-53779
title: WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows
summary: >-
  WebP Server Go through 0.14.4 contains a path traversal vulnerability on
  Windows that allows unauthenticated attackers to read files outside the
  configured IMG_PATH directory by sending requests with percent-encoded
  backslashes (%5C) tha…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: webp-sh
product: webp_server_go
affected:
  - webp_server_go < 0.15.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-23T14:12:03.904360Z'
published: '2026-06-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:17:47.007Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53779'
references:
  - url: 'https://github.com/webp-sh/webp_server_go/pull/451'
    label: Pull Request
  - url: >-
      https://github.com/webp-sh/webp_server_go/commit/eb3b5f9289b331cb639cd610b0d1c532d2cc24e0
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows
tags:
  - cve.org
epss: 0.00587
epssPercentile: 0.45724
ingestedAt: '2026-09-24T15:45:56.728Z'
---

## Overview

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.

## Affected

- `webp_server_go < 0.15.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.