CVE-2026-52792

Name of the Vulnerable Software and Affected Versions Algernon version 1.17.8

Description On Windows hosts using the NTFS filesystem, an unauthenticated client can retrieve the raw source code of server-side scripts (such as .lua, .tl, .po2, .amber, or .frm) located on public paths. This occurs because the software uses filepath.Ext() to determine the file handler, which does not recognize NTFS-equivalent naming conventions. By appending suffixes such as ::$DATA, a trailing dot ., or a trailing space to the filename, the request bypasses the script execution logic and falls through to a default handler that streams the file bytes verbatim to the client. This can lead to the disclosure of sensitive embedded secrets, including database credentials and the SetCookieSecret value, the latter of which could allow an attacker to forge session cookies and impersonate users.

Recommendations For version 1.17.8, reject request paths where the final segment uses Windows-equivalent forms, specifically those containing a colon : or ending with a dot . or a space. As a temporary mitigation, restrict access to the public paths containing server-side scripts to minimize the risk of source code disclosure.