CVE-2026-73255

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description An issue exists in the embedded web server and network library where an attacker controlling an SSI-enabled file can use directory traversal sequences within an #include file or #include virtual directive. This occurs because the mg ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without utilizing the mg path is sane() function. Consequently, deployments using MG ENABLE SSI with a configured ssi pattern may disclose files readable by the Mongoose process.

Recommendations Update to version 7.22. As a temporary mitigation, restrict the use of the mg ssi() function or disable the MG ENABLE SSI configuration.