Drogon CVE-2026-105144

Requires that the target run Drogon (up to 1.9.13-1 / 10.0-beta.3) on Windows and serve static files via the Static File Router (StaticFileRouter::route), i.e. an application configured to expose a static document root. No authentication and no user interaction are required per PR:N/UI:N. The primary limiting factors are: the platform must be Windows (the flaw is described as Windows-specific, so Linux/macOS deployments may not be affected), static-file serving must be enabled and reachable, and the realistic payoff is bounded to files readable by the server process - impact is disclosure only (VI:N/VA:N).

Signals are mixed and point to a moderate, not emergency, priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack, which maximizes reachability, but the impact is deliberately scoped low (VC:L, with VI:N/VA:N), yielding a 6.9 (Medium) score - this is information disclosure only, not code execution. The E:P value in the vector and the description's statement that 'the exploit has been published' confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation - POC availability must not be conflated with exploitation. The vendor was contacted and did not respond, meaning NO official patch or advisory is confirmed, which raises operational risk for deployers. The single reporting source (VulDB) and absence of an NVD-enriched record or vendor confirmation lower overall confidence. Net: a credible, easy-to-trigger file-disclosure bug with public PoC, but limited blast radius and a niche product footprint keep it below top-priority unless Drogon is confirmed in your Windows-facing environment. Note the impact assessment is conservative - a path-traversal static-file flaw could in practice expose more sensitive files than VC:L suggests; verify the actual readable scope.

A remote, unauthenticated attacker sends a crafted HTTP request to a Windows-hosted Drogon application containing directory-traversal sequences in the static-file path handled by StaticFileRouter::route. Because the router fails to properly canonicalize/normalize the path, the server returns files outside the intended static web root, disclosing application source, configuration, or other readable files. Published exploit code is reported to exist, and the low attack complexity (AC:L) means no special timing or preconditions are needed.