CVE-2026-49846 Overview
CVE-2026-49846 is a path traversal vulnerability in libks, a library that provides foundational support for SignalWire C products. The flaw resides in the clean_uri() function within the HTTP request parser. Prior to version 2.0.11, clean_uri() fails to reject URIs whose path contains more segments than its internal canonicalization buffer can hold. When this limit is exceeded, canonicalization silently passes the URI through with embedded .. sequences intact. Any downstream consumer that joins the URI with a filesystem path becomes vulnerable to directory traversal [CWE-22]. Version 2.0.11 patches the issue.
Critical Impact
Remote unauthenticated attackers can read arbitrary files outside intended web roots by crafting URIs that bypass canonicalization in libks HTTP consumers.
Affected Products
- SignalWire libks versions prior to 2.0.11
- Downstream SignalWire C products that consume libks for HTTP request parsing
- Applications that join libks-parsed URI paths with filesystem paths
Discovery Timeline
- 2026-09-11 - CVE-2026-49846 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-49846
Vulnerability Analysis
The clean_uri() function in libks is responsible for canonicalizing HTTP request URIs before they are consumed by higher-level application logic. Canonicalization normally resolves . and .. segments and produces a safe, absolute path. In libks prior to 2.0.11, the routine uses a fixed-size internal buffer to hold path segments during processing. When an incoming URI contains more segments than this buffer can accommodate, the function does not return an error or reject the request. It silently short-circuits and returns the original, un-canonicalized URI. The result is that .. traversal sequences remain intact in the path handed to downstream code.
Root Cause
The root cause is missing input validation combined with a fail-open design. The canonicalization step should treat buffer exhaustion as a hard failure and reject the URI. Instead, it forwards the raw path, violating the caller's expectation that the returned URI is safe to append to a base directory.
Attack Vector
An unauthenticated remote attacker sends an HTTP request with a crafted URI containing enough path segments to exceed the internal canonicalization buffer, followed by .. traversal sequences. When a libks consumer concatenates the returned path with a filesystem root, the traversal sequences resolve outside the intended directory. This grants read access to sensitive files depending on the process privileges of the consuming service. Exploitation requires no authentication, no user interaction, and no special network position beyond reachability of the vulnerable HTTP endpoint.
No verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-684h-wjm9-2p6j.
Detection Methods for CVE-2026-49846
Indicators of Compromise
- HTTP request logs containing URIs with unusually long path segment counts followed by .. sequences
- Access log entries referencing files outside the expected web root or static asset directory
- Unexpected file read activity by SignalWire or FreeSWITCH-adjacent processes linked against libks
Detection Strategies
- Inspect HTTP access logs for URIs containing repeated segment patterns combined with %2e%2e, .., or mixed-encoding traversal tokens
- Deploy web application firewall rules that reject requests whose path segment count exceeds a defined threshold
- Correlate HTTP request telemetry with filesystem access events from services that embed libks to identify anomalous file reads
Monitoring Recommendations
- Enable verbose HTTP request logging on services that link against libks and forward logs to a centralized analytics platform
- Alert on filesystem reads of sensitive paths such as /etc/passwd, private keys, and configuration files by SignalWire-related processes
- Track outbound responses containing file contents that do not match served static assets
How to Mitigate CVE-2026-49846
Immediate Actions Required
- Upgrade libks to version 2.0.11 or later across all systems and rebuild downstream SignalWire C products against the patched library
- Inventory all services that embed or dynamically link against libks and prioritize internet-facing deployments
- Deploy WAF rules that block URIs containing traversal sequences until patching is complete
Patch Information
libks version 2.0.11 fixes CVE-2026-49846 by correcting the clean_uri() canonicalization logic so that URIs exceeding the internal buffer capacity are rejected rather than passed through unmodified. Refer to the GitHub Security Advisory GHSA-684h-wjm9-2p6j for the upstream fix commit and release notes.
Workarounds
- Place a reverse proxy in front of libks-based services that normalizes and validates URIs before forwarding requests
- Configure the consuming application to reject any resolved filesystem path that escapes the intended base directory
- Restrict the file system privileges of processes linking against libks so that traversal reads cannot access sensitive files
See the GitHub Security Advisory for upstream configuration guidance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
