CVE-2026-53779

Name of the Vulnerable Software and Affected Versions WebP Server Go versions prior to 0.14.5

Description An issue on Windows allows unauthenticated attackers to read files outside the configured IMG PATH directory. This occurs because the path.Clean() sanitization in handler/router.go is bypassed when requests contain percent-encoded backslashes (%5C). The flaw stems from a discrepancy where Go performs path normalization using only forward slashes, while Windows file system APIs treat both backslashes and forward slashes as equivalent, enabling access to arbitrary files on the host filesystem accessible to the server process.

Recommendations Update to version 0.14.5 or later.