EUVD-2026-76756Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable HTTP parser, no auth or interaction required; impact is read-only file disclosure, so I:N and A:N are appropriate.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean_uri() in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.
AnalysisAI
Path traversal in SignalWire's libks HTTP request parser exposes consumers to arbitrary file read. The clean_uri() function fails to reject oversized URI paths - when the path contains more segments than the internal canonicalization buffer accommodates, embedded .. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required and no special client state is needed - the vulnerability is reachable via any HTTP request processed by a libks-based application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N places this firmly in the remotely exploitable, zero-friction category - no credentials, no user interaction, and no special network position required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libks to version 2.0.11, which patches `clean_uri()` to reject URIs whose path segment count exceeds the internal canonicalization buffer capacity. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and systems using SignalWire's libks and confirm versions deployed across production and development environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today