CVE-2026-28679: Home-gallery Path Traversal Vulnerability

CVE-2026-28679 Overview

CVE-2026-28679 is a Path Traversal vulnerability affecting Home-Gallery, a self-hosted open-source web gallery application designed for browsing personal photos and videos. Prior to version 1.21.0, the application fails to verify whether a requested file is located within the media source directory when processing download requests. This lack of path validation can allow attackers to download sensitive system files from the server.

Critical Impact
Unauthenticated attackers can exploit this vulnerability to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, and other system data.

Affected Products

Home-Gallery Homegallery versions prior to 1.21.0

Discovery Timeline

2026-03-06 - CVE CVE-2026-28679 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-28679

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in Home-Gallery's download functionality, which accepts user-supplied file paths without proper validation.

When a user initiates a file download through the gallery interface, the application constructs a file path based on user input. However, the application does not sanitize or validate that the resulting path remains within the intended media source directory. This allows an attacker to craft malicious requests containing path traversal sequences to escape the media directory and access files elsewhere on the filesystem.

The vulnerability can be exploited remotely over the network without authentication, making it particularly dangerous for publicly accessible Home-Gallery instances. Successful exploitation grants read access to any file on the server that the application process has permissions to read.

Root Cause

The root cause of this vulnerability is the absence of path validation in the file download handler. The application trusts user-supplied input when constructing file paths for download operations, failing to implement checks that would ensure the resolved path remains within the designated media source directory. This allows path traversal sequences such as ../ to navigate outside the intended directory structure.

Attack Vector

The attack vector for CVE-2026-28679 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the Home-Gallery download endpoint containing directory traversal sequences.

For example, an attacker could manipulate the download path parameter to include sequences like ../../../etc/passwd to traverse up the directory tree and access system files. The attacker could potentially retrieve sensitive files such as:

System configuration files (e.g., /etc/passwd, /etc/shadow if readable)
Application configuration files containing credentials
SSH keys or other authentication materials
Environment files with secrets or API keys

The attack can be executed with a simple HTTP request modification, making it easily exploitable with basic tools like curl or a web browser's developer tools.

Detection Methods for CVE-2026-28679

Indicators of Compromise

HTTP request logs showing download requests containing ../ or encoded path traversal sequences (%2e%2e%2f)
Access logs with requests attempting to retrieve files outside the media directory, such as system files (/etc/passwd, /proc/self/environ)
Unusual file access patterns from the Home-Gallery application process
Download requests for files with absolute paths or paths referencing sensitive directories

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns
Monitor Home-Gallery access logs for suspicious download requests with unusual path patterns
Deploy intrusion detection systems (IDS) with signatures for directory traversal attacks
Audit file access events on the server to detect reads of sensitive files by the gallery application

Monitoring Recommendations

Enable verbose logging for the Home-Gallery application to capture all download requests with full path information
Set up alerting for any download requests that contain traversal patterns or reference files outside the media directory
Monitor system file access logs for unauthorized reads by the web application user
Regularly review application logs for failed or unusual file access attempts

How to Mitigate CVE-2026-28679

Immediate Actions Required

Upgrade Home-Gallery to version 1.21.0 or later immediately
If unable to upgrade, restrict network access to the Home-Gallery instance using firewall rules
Review server logs for any signs of exploitation prior to patching
Audit any files that may have been exposed if exploitation is suspected

Patch Information

The vulnerability has been patched in Home-Gallery version 1.21.0. The patch implements proper path validation to ensure that download requests cannot access files outside the media source directory. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to the GitHub Release v1.21.0 and the GitHub Security Advisory GHSA-xj65-hcj5-h6j3.

Workarounds

Place Home-Gallery behind a reverse proxy with request filtering to block path traversal patterns
Use a web application firewall (WAF) to filter malicious requests containing directory traversal sequences
Restrict network access to the Home-Gallery instance to trusted networks or users only
Run Home-Gallery with minimal file system permissions to limit the impact of potential exploitation
Consider temporarily disabling the download functionality if it is not essential until the patch can be applied

bash

# Example nginx configuration to block path traversal attempts
location / {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    proxy_pass http://localhost:3000;
}