CVE-2026-52792: Algernon Web Server Info Disclosure Bug

CVE-2026-52792 Overview

CVE-2026-52792 is a source code disclosure vulnerability in Algernon, a self-contained pure-Go web server. Versions prior to 1.17.9 running on Windows fail to reject NTFS-equivalent filename aliases such as x.lua::$DATA, x.lua., and x.lua (trailing space). An unauthenticated remote attacker can append these suffixes to public server-side scripts using .lua, .tl, .po2, .amber, or .frm extensions. The server returns raw script source instead of executing the file, exposing embedded secrets. Linux and macOS deployments are not affected.

Critical Impact
Raw script source disclosure can expose database credentials, API keys, and the SetCookieSecret value, enabling forged session cookies and full application compromise.

Affected Products

Algernon web server on Windows, versions prior to 1.17.9
Server-side scripts with .lua, .tl, .po2, .amber, or .frm extensions
Applications relying on Algernon's SetCookieSecret for session integrity

Discovery Timeline

2026-08-19 - CVE-2026-52792 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52792

Vulnerability Analysis

The flaw resides in Algernon's handler selection logic in engine/handlers.go. The server calls Go's filepath.Ext() to determine which handler processes an incoming request. On Windows, NTFS accepts several filename variants that resolve to the same underlying file but produce different extension strings when parsed by filepath.Ext(). Suffixes such as ::$DATA (the default NTFS data stream), a trailing dot, or a trailing space cause the extension check to fail while the filesystem still opens the target script.

The request path traverses URL2filename in utils/files.go, bypasses the renderer and execution branches, and falls through to FilePage, os.Open, ReadAndLogErrors, and ToClient. The handler streams the file contents directly to the client. This class of issue is tracked as [CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream].

Root Cause

The root cause is trust in filepath.Ext() output without normalizing Windows-specific filename aliases before dispatch. filepath.Ext("x.lua::$DATA") returns .lua::$DATA rather than .lua, so the request skips the Lua interpreter path. NTFS then resolves the alias to x.lua when the file is opened, and the raw source is returned.

Attack Vector

An unauthenticated attacker sends a single HTTP GET request to a known script URL with an appended NTFS alias suffix. Example request paths include /app.lua::$DATA, /app.lua., or /app.lua%20. The response body contains the plaintext script, including any hardcoded secrets. Attackers can then extract the SetCookieSecret value and forge authenticated session cookies.

// FilePage tries to serve a single file. The file must exist. Must be given a full filename.
func (ac *Config) FilePage(w http.ResponseWriter, req *http.Request, filename, luaDataFilename string) {
	// Reject specially crafted Windows filenames that alias a different file
	// than filepath.Ext sees, for example "x.lua::$DATA", "x.lua." or "x.lua ".
	if base := filepath.Base(filename); strings.ContainsRune(base, ':') ||
		strings.HasSuffix(base, ".") || strings.HasSuffix(base, " ") {
		http.NotFound(w, req)
		return
	}

	if ac.quitAfterFirstRequest {
		go ac.quitSoon("Quit after first request", defaultSoonDuration)
	}

Source: GitHub Commit a6b0724. The patch rejects filenames containing :, trailing dot, or trailing space before serving.

Detection Methods for CVE-2026-52792

Indicators of Compromise

HTTP access log entries containing request paths with ::$DATA, trailing ., or trailing space (URL-encoded as %20) appended to script extensions.
Successful 200 OK responses to requests for .lua, .tl, .po2, .amber, or .frm files with unusual response Content-Type such as text/plain or application/octet-stream.
Response body sizes for script URLs that match on-disk source file sizes rather than rendered output.
Outbound authentication attempts using session cookies not tied to a preceding login event, indicating forged cookies signed with a leaked SetCookieSecret.

Detection Strategies

Deploy web application firewall (WAF) rules that block requests containing ::$DATA, trailing dots, or trailing whitespace in URI paths.
Alert on any HTTP request URI matching the regex pattern \.(lua|tl|po2|amber|frm)(::|\.|%20|\s) at the reverse proxy or IIS layer.
Correlate script file reads on the Windows host against corresponding HTTP handler invocations to identify handler bypass events.

Monitoring Recommendations

Enable verbose HTTP logging on Algernon and forward logs to a central SIEM for pattern matching on NTFS alias suffixes.
Monitor filesystem audit logs for os.Open reads of script files that lack a preceding script execution event.
Rotate and monitor use of any secret that may have been embedded in Algernon script files.

How to Mitigate CVE-2026-52792

Immediate Actions Required

Upgrade Algernon to version 1.17.9 or later on all Windows hosts.
Rotate all secrets embedded in .lua, .tl, .po2, .amber, and .frm files, including database credentials, API keys, and the SetCookieSecret value.
Invalidate all active session cookies after rotating SetCookieSecret to prevent replay of forged cookies.
Review web server access logs for prior exploitation attempts using NTFS alias suffixes.

Patch Information

The fix is delivered in Algernon v1.17.9. The commit adds a filename validation check in FilePage that rejects any request whose base filename contains :, ends in ., or ends in a space. Full technical detail is available in GitHub Security Advisory GHSA-mm6c-5j6x-hq8m.

Workarounds

Front Algernon with a reverse proxy that strips or rejects request paths containing ::$DATA, trailing dots, or trailing whitespace.
Migrate Algernon deployments from Windows to Linux or macOS hosts, which are not affected by NTFS alias resolution.
Move all secrets out of script source files and into environment variables or a secrets manager accessed at runtime.

bash

# Example nginx reverse proxy rule to block NTFS alias suffixes
location ~* "\.(lua|tl|po2|amber|frm)(::|\.|\s|%20)" {
    return 404;
}