Katrielmoses

**Name of the Vulnerable Software and Affected Versions** Algernon versions prior to 1.17.6 **Description** In the `engine/luahandler.go` file, the `sync.RWMutex` protecting `LoadCommonFunctions` is released before the `L.Push()` and `L.PCall()` functions execute. Because the `LState` of gopher-lua is not goroutine-safe, concurrent requests create a race condition on the shared state, leading to Lua VM corruption. **Recommendations** Update to version 1.17.6.

**Name of the Vulnerable Software and Affected Versions** Algernon versions prior to 1.17.6 **Description** The `uploadedFileSaveIn()` function in lua/upload/upload.go uses `filepath.Join()` with a directory provided by the caller without performing a boundary check after the operation. This allows a directory path such as `../../../tmp` to resolve to `/tmp`, enabling files to be saved outside the intended web root. **Recommendations** Update to version 1.17.6.