CVE-2026-45721: Algernon Web Server Upward handler.lua Lookup Leading to Remote Code Execution
Algernon versions before 1.17.7 search parent directories beyond the configured server root for a handler.lua file when a directory without an index is requested. The first match is loaded into the Lua interpreter with the full Algernon API, and the record describes this as reachable without authentication. The record states the issue is fixed in 1.17.7, and no confirmed exploitation appears in the sources consulted.
Overview
Algernon is a small self-contained pure-Go web server. According to the advisory record, versions before 1.17.7 resolve a handler.lua file by walking upward from a directory that has no index file, past the configured server root. The record attributes this to the DirPage routine.
Impact
The record describes the outcome as pre-authenticated remote code execution. The reported prerequisite is that a process must be able to write a handler.lua file in a parent directory of the server root. According to the record, the Lua environment that runs the file exposes the full Algernon API, including process execution, network client, database and filesystem functions.
Affected products and versions
- Algernon versions prior to 1.17.7, as stated in the record.
- The record's affected product list is empty, so the exact package names and version ranges beyond the phrase prior to 1.17.7 are not confirmed by structured data.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS value in the record is 0.00744 with a percentile of 0.53528.
Remediation and mitigation
- Upgrade Algernon to version 1.17.7 or later, which the record identifies as the fixed release.
- Until upgrading, restrict who can create or modify files in any parent directory of the server root, and remove any unexpected handler.lua files found there.
- Run the server under a dedicated low-privilege account and limit its filesystem and network reach so that a compromise has less impact.
- Review the official advisory at GitHub Security Advisory GHSA-xwcr-wm99-g9jc for the maintainer's current guidance.
Detection guidance
- Inventory all Algernon instances and record their versions to identify those older than 1.17.7.
- Monitor parent directories of server roots for creation or modification of files named handler.lua, for example with file integrity monitoring.
- Review web server logs for requests to directory paths without index files, and correlate them with unexpected file changes on the host.
- Watch for unexpected child processes or outbound connections originating from the Algernon process.
Limitations of the available information
The record does not include structured affected version ranges, fixed version entries, SSVC data or KEV details beyond a listed value of false. The record gives a severity of critical and a CVSS 3.1 base score of 9 from the GitHub Security Advisories provider. The published date is 2026-05-26 and the EPSS date field reads 2026-10-13, which should be verified against the source. Details about how the vulnerability was discovered or validated are unknown.
Frequently asked questions
Which Algernon versions are affected by CVE-2026-45721?
The record states that versions prior to 1.17.7 are affected. The structured affected product list in the record is empty, so exact package names beyond that statement are not confirmed.
Is there a fix available?
Yes. The record states the vulnerability is fixed in 1.17.7. Upgrading to that version or later is the recommended remediation.
Is this CVE known to be exploited in the wild?
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.