EUVD-2026-38340
GHSA-pv77-wrq6-gq73
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network request triggers arbitrary file read on Windows hosts (AV:N/AC:L/PR:N/UI:N); confidentiality only (C:H, I:N, A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.
AnalysisAI
Arbitrary file read in WebP Server Go through 0.14.4 on Windows deployments allows unauthenticated remote attackers to retrieve files outside the configured IMG_PATH by sending HTTP requests containing percent-encoded backslashes (%5C), bypassing the path.Clean() sanitization in handler/router.go. The flaw is platform-specific to Windows hosts because Go normalizes only forward slashes while the Windows file API treats backslashes equivalently; no public exploit identified at time of analysis, though VulnCheck has published an advisory and an upstream fix is merged in 0.15.0.
Technical ContextAI
WebP Server Go is a Go-based HTTP service that converts and serves images as WebP, typically deployed behind a reverse proxy and reading from a configured IMG_PATH directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): handler/router.go relies on Go's path.Clean(), which canonicalizes only forward-slash separators per POSIX semantics, while the underlying Windows Win32/NT file APIs accept '\' and '/' interchangeably. By URL-encoding backslashes as %5C, an attacker delivers a separator that survives Go's sanitization but is then resolved by Windows as a directory traversal token (e.g., '..\..\Windows\win.ini'). The affected CPE webp-sh:webp_server_go covers all versions up to and including 0.14.4 per NVD; the bug does not appear on Linux/macOS where '\' is a valid filename character rather than a separator.
RemediationAI
Vendor-released patch: upgrade to WebP Server Go 0.15.0 or later, which corrects the path normalization in handler/router.go (fix commit eb3b5f9289b331cb639cd610b0d1c532d2cc24e0, merged via PR #451). Until the upgrade is applied, Windows operators should follow the project's deployment guidance by binding the service to 127.0.0.1 and exposing it only through a reverse proxy (Nginx/Caddy) that rejects or decodes %5C/backslash sequences before forwarding, or by relocating the deployment to a Linux container where the vulnerability does not manifest; both reduce exposure but do not remove the root cause. Restricting the service process to a least-privilege account that only has read access to the intended IMG_PATH tree limits the blast radius of any successful traversal, at the cost of requiring careful ACL configuration. See https://github.com/webp-sh/webp_server_go/pull/451 and https://www.vulncheck.com/advisories/webp-server-go-path-traversal-via-backslash-encoding-on-windows for full advisory details.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today