Skip to main content

facil.io CVE-2026-16653

| EUVDEUVD-2026-47867 MEDIUM
Path Traversal (CWE-22)
2026-07-23 VulDB GHSA-fh8x-qh3j-vhfv
Path Traversal Facil Io
5.5
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-accessible unauthenticated path traversal yields partial file read only; no integrity or availability impact, no scope change beyond the vulnerable process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jul 23, 2026 - 02:22 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
Analysis Generated
Jul 23, 2026 - 02:01 vuln.today
CVE Published
Jul 23, 2026 - 01:15 cve.org
MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the http_sendfile2 function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted HTTP GET with traversal payload
Delivery
http_sendfile2 processes unsanitized path
Exploit
Resolve path outside configured web root
Execution
Read arbitrary file accessible to server process
Impact
Return file contents in HTTP response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The Public Folder Handler feature must be active - this is the specific facil.io capability that routes requests through `http_sendfile2` for static file serving; deployments using facil.io purely as an HTTP API framework without static serving enabled are not affected by this code path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) establishes this as a straightforward, unauthenticated, network-reachable read primitive with low confidentiality impact and no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated remote attacker sends an HTTP GET request to a publicly reachable facil.io server containing a traversal payload such as `GET /../../../../etc/passwd HTTP/1.1`, causing `http_sendfile2` to resolve the path outside the configured public folder and return the contents of the targeted file in the HTTP response body. Since a public exploit has been released and the attack requires no authentication or special preconditions, any facil.io instance with the Public Folder Handler exposed to untrusted networks is immediately actionable by a script-kiddie-level adversary.
Remediation No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure at https://github.com/boazsegev/facil.io/issues/170, so no fixed version can be cited. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Facil Io

View all
CVE-2026-66731 HIGH POC
8.7 Jul 27

Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash
CVE-2026-66730 HIGH POC
8.7 Jul 27

Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the se
CVE-2026-66729 HIGH POC
8.7 Jul 27

Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by
CVE-2026-41146 HIGH
8.7 Apr 22

Remote unauthenticated denial of service affects facil.io (all versions prior to commit 5128747) and iodine (all version

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2023-47246 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8

Share

CVE-2026-16653 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy