CVE-2026-53779 WebP Server Go < 0.15.0 Path Traversal via Backslash Encoding on Windows
Unauthenticated attackers can read arbitrary files on Windows hosts by exploiting path traversal via backslash encoding in WebP Server Go.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53779?
CVE-2026-53779 is a high-severity path traversal vulnerability in webp-sh webp_server_go, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.
Weakness: CWE-22
Which versions are affected by CVE-2026-53779?
How do I fix CVE-2026-53779?
No fix has been published for CVE-2026-53779 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53779 being exploited?
There is no known exploitation of CVE-2026-53779 in the wild and no public exploit code.
Sources
Also known as GHSA-pv77-wrq6-gq73.