Xyproto vulnerabilities
We track 7 vulnerabilities in Xyproto products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest Xyproto vulnerabilities
- 9.4 Critical severity
algernon: Improper Handling of Case Sensitivity
Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is late
- 8.7 High severity
algernon: Improper Handling of Windows ::DATA Alternate Data Stream
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauth
- 8.2 High severity
algernon: Improper Limitation of a Pathname to a Restricted Directory
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configu
- 7.5 High severity
algernon: Generation of Error Message Containing Sensitive Information
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whic
- 9.0 Critical severity
Algernon is a small self-contained pure-Go web server.
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index file, DirPage walks upward through parent directories — past the configured server root — looking for
- 8.7 High severity
algernon: Improper Limitation of a Pathname to a Restricted Directory
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves clea
- 8.2 High severity
algernon: Concurrent Execution using Shared Resource with Improper Synchronization
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, conc