CVE-2026-53779: WebP Server Go Path Traversal Flaw

CVE-2026-53779 Overview

CVE-2026-53779 is a path traversal vulnerability in WebP Server Go through version 0.14.4 running on Windows. Unauthenticated attackers can read files outside the configured IMG_PATH directory by sending HTTP requests containing percent-encoded backslashes (%5C). The encoded backslashes bypass the path.Clean() sanitization performed in handler/router.go. The flaw exploits a discrepancy between Go's forward-slash-only path normalization and Windows file system APIs, which treat backslashes and forward slashes as equivalent. The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Remote unauthenticated attackers can read arbitrary files on the host filesystem accessible to the WebP Server Go process, leading to disclosure of configuration files, credentials, and sensitive application data.

Affected Products

WebP Server Go versions up to and including 0.14.4
Deployments running on the Windows operating system
Configurations relying on IMG_PATH as a sandbox boundary for served files

Discovery Timeline

2026-06-22 - CVE-2026-53779 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-53779

Vulnerability Analysis

WebP Server Go serves images from a configured IMG_PATH directory. The request handler in handler/router.go applies Go's path.Clean() to normalize incoming URI paths before resolving them against the image root. path.Clean() operates strictly on forward slashes and treats backslashes as ordinary filename characters. On Windows, however, the underlying file system APIs interpret both / and \ as path separators. An attacker can submit a URI containing percent-encoded backslashes (%5C), which the HTTP layer decodes into literal backslashes after sanitization. These backslashes are then honored as directory separators by the Windows filesystem, allowing traversal sequences such as ..\..\ to escape the intended directory.

Root Cause

The root cause is a sanitization mismatch between Go's platform-agnostic path package and Windows-specific path semantics. The router validates the cleaned path assuming forward-slash separators are the only traversal vector. Because path.Clean() does not collapse ..\ segments, the check fails to detect parent-directory traversal on Windows hosts.

Attack Vector

The attacker sends an unauthenticated HTTP request to the WebP Server Go endpoint with a path containing %5C..%5C..%5C sequences targeting files outside IMG_PATH. The server decodes the percent-encoded bytes, passes them through path.Clean() without rejection, and resolves the resulting path against the Windows filesystem. Files readable by the server process — including configuration files, application secrets, and Windows system files — are returned in the HTTP response.

// Security patch in config/config.go - fix traverse (#451)
	DumpSystemd         bool
	DumpConfig          bool
	ShowVersion         bool
-	ProxyMode           bool
	AllowAllExtensions  bool
	Prefetch            bool // Prefech in go-routine, with WebP Server Go launch normally
	PrefetchForeground  bool // Standalone prefetch, prefetch and exit
	AllowNonImage       bool
	Config              = NewWebPConfig()
-	Version             = "0.14.4"
+	Version             = "0.15.0"
	WriteLock           = cache.New(5*time.Minute, 10*time.Minute)
	ConvertLock         = cache.New(5*time.Minute, 10*time.Minute)
	LocalHostAlias      = "local"

Source: GitHub Commit eb3b5f9

The upstream patch also introduces a new handler/state.go module that formalizes request modes and centralizes URI handling to prevent traversal bypass:

// New handler/state.go - fix traverse (#451)
package handler

import (
	"net/url"
	"regexp"
	"strings"
	"webp_server_go/config"

	log "github.com/sirupsen/logrus"
)

type requestMode string

const (
	requestModeLocalDefault  requestMode = "local_default"
	requestModeLocalMapped   requestMode = "local_mapped"
	requestModeRemoteDefault requestMode = "remote_default"
	requestModeRemoteMapped  requestMode = "remote_mapped"
)

type requestState struct {
	mode            requestMode
	reqURI          string
	reqURIWithQuery string
	targetHostName  string
	targetHost      string
	mapLocalBase    string
	realRemoteAddr  string
}

Source: GitHub Commit eb3b5f9

Detection Methods for CVE-2026-53779

Indicators of Compromise

HTTP request URIs containing %5C sequences, particularly in combination with .. segments targeting WebP Server Go endpoints
Access log entries showing successful responses for paths resolving outside the configured IMG_PATH directory
Unexpected file reads by the WebP Server Go process against sensitive Windows paths such as C:\Windows\System32\ or application config directories

Detection Strategies

Inspect HTTP access logs for percent-encoded backslashes (%5C, %5c) and traversal patterns such as %5C..%5C in request URIs
Deploy web application firewall rules that decode URL-encoded sequences before evaluating traversal patterns
Compare requested paths against the canonical IMG_PATH boundary after full decoding to flag escape attempts

Monitoring Recommendations

Enable verbose request logging on WebP Server Go and forward logs to a centralized analytics platform for traversal pattern matching
Alert on responses returning non-image MIME types or unusually large file payloads from image endpoints
Monitor the WebP Server Go process for file handle activity outside IMG_PATH using endpoint telemetry

How to Mitigate CVE-2026-53779

Immediate Actions Required

Upgrade WebP Server Go to version 0.15.0 or later, which contains the patch from pull request #451
Restrict the operating system permissions of the WebP Server Go service account so it cannot read files outside the intended image directory
Place the service behind a reverse proxy that rejects requests containing %5C or raw backslashes

Patch Information

The fix is delivered in commit eb3b5f9 and shipped in version 0.15.0. The patch removes the ProxyMode flag, restructures request handling through a new handler/state.go state machine, and corrects URI normalization so that backslash-based traversal sequences are rejected before filesystem resolution. Additional context is available in the VulnCheck advisory.

Workarounds

Deploy WebP Server Go on Linux or another non-Windows operating system where backslashes are not treated as path separators
Configure an upstream proxy (NGINX, IIS, Caddy) to drop or normalize requests containing %5C, %5c, or literal \ characters before they reach the application
Run the WebP Server Go process under a least-privilege Windows account whose access is limited to the IMG_PATH directory tree

bash

# Example NGINX rule to block backslash-encoded traversal upstream of WebP Server Go
location / {
    if ($request_uri ~* "%5[Cc]") {
        return 400;
    }
    proxy_pass http://webp_server_go_upstream;
}