CVE-2026-16653: facil.io Path Traversal Vulnerability

CVE-2026-16653 Overview

CVE-2026-16653 is a path traversal vulnerability [CWE-22] affecting boazsegev facil.io versions up to 0.7.58. The flaw resides in the http_sendfile2 function within lib/facil/http/http.c, which handles requests routed through the Public Folder Handler component. An unauthenticated remote attacker can manipulate request paths to access files outside the intended public directory. The exploit has been publicly released and the maintainer has not responded to the issue report at the time of publication.

Critical Impact
Remote unauthenticated attackers can read arbitrary files on the host by supplying crafted paths to the facil.io static file handler, exposing configuration, credentials, and source code.

Affected Products

boazsegev facil.io versions up to and including 0.7.58
Applications embedding the facil.io HTTP server library
Deployments exposing the Public Folder Handler over the network

Discovery Timeline

2026-07-23 - CVE-2026-16653 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-16653

Vulnerability Analysis

The vulnerability is a classic path traversal in the static file serving path of facil.io. The http_sendfile2 function in lib/facil/http/http.c constructs a filesystem path by concatenating the configured public root with a user-supplied URI segment. Insufficient normalization of relative path components (../) permits attackers to escape the intended directory boundary. Because facil.io is embedded in application servers and used to serve static assets, any deployment relying on the Public Folder Handler is exposed. The public availability of a working exploit and the absence of a vendor patch increase real-world risk for internet-facing services.

Root Cause

The root cause is missing or incomplete canonicalization of user-controlled path input before it is passed to the file open routine. The http_sendfile2 function trusts the requested path after basic decoding and fails to reject sequences that resolve above the public folder root. Requests containing dot-dot segments, encoded variants, or absolute path indicators reach the underlying file system call intact.

Attack Vector

Exploitation requires only network access to a facil.io HTTP endpoint that serves a public folder. The attacker issues an HTTP GET request whose URI contains directory traversal sequences targeting sensitive files such as /etc/passwd, application configuration files, or private keys stored on the host. No authentication, user interaction, or elevated privileges are required. The response returns the file contents when the traversal succeeds and the target file is readable by the facil.io process.

No verified proof-of-concept code is included here. Refer to the GitHub Issue #170 and VulDB CVE-2026-16653 entry for technical details of the disclosed exploit.

Detection Methods for CVE-2026-16653

Indicators of Compromise

HTTP request logs containing ../, ..%2f, %2e%2e%2f, or similar encoded traversal sequences targeting facil.io endpoints
Access log entries returning HTTP 200 for URIs that reference files outside the configured public folder
Unexpected reads of sensitive files (/etc/passwd, .env, private keys) by the facil.io process user
Outbound transfer of files that are not part of the intended static asset set

Detection Strategies

Deploy web application firewall rules that block path traversal patterns in URIs before they reach facil.io
Correlate HTTP access logs with filesystem audit events to identify reads outside the public root
Baseline the set of files legitimately served by the Public Folder Handler and alert on deviations

Monitoring Recommendations

Enable verbose HTTP request logging on facil.io front ends and forward logs to a centralized SIEM
Monitor Linux auditd or equivalent for open and openat syscalls against sensitive paths by the web server process
Track error rates and 200-response rates on static file routes for statistical anomalies

How to Mitigate CVE-2026-16653

Immediate Actions Required

Disable the Public Folder Handler in facil.io deployments until a patched release is available
Place a reverse proxy such as nginx or a WAF in front of facil.io to normalize and filter request paths
Restrict filesystem permissions so the facil.io process cannot read files outside the intended static content directory
Audit access logs for historical traversal attempts and rotate any credentials that may have been exposed

Patch Information

No vendor patch is available at the time of publication. The maintainer was informed through GitHub Issue #170 but has not responded. Track the facil.io repository for future releases addressing this issue.

Workarounds

Serve static assets from a hardened reverse proxy rather than the facil.io Public Folder Handler
Run facil.io inside a container or chroot with only the public asset directory mounted read-only
Apply strict URI validation at an upstream layer to reject requests containing .., encoded traversal sequences, or absolute paths
Enforce mandatory access controls such as AppArmor or SELinux profiles limiting file reads to the public folder

bash

# Example nginx reverse proxy filter to block traversal patterns before facil.io
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 400;
    }
    proxy_pass http://facilio_backend;
}