Mongoose CVE-2026-73255

Three simultaneous non-default conditions must be present: (1) Mongoose must be compiled with MG_ENABLE_SSI defined - this is a compile-time opt-in, not enabled in default builds; (2) the ssi_pattern runtime configuration must be set to match files served by the web server; and (3) the attacker must be able to place or influence the content of at least one SSI-enabled file (e.g., via a file upload feature, user-controlled template, or other write-capable application path). Authentication is required per CVSS PR:L - unauthenticated exploitation is not indicated. Exploitation is limited to reading files accessible by the Mongoose process account; no code execution or write capability is introduced by this flaw. Deployments without MG_ENABLE_SSI are entirely unaffected regardless of version.

The NVD CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5, reflecting network-reachable exploitation requiring low-privilege credentials with high confidentiality impact but no integrity or availability effect. However, two non-default preconditions substantially reduce realistic risk: the MG_ENABLE_SSI compile-time flag must be enabled (it is not the default build), and ssi_pattern must be configured to expose SSI-processed files. Additionally, the attacker must have some application-level ability to influence SSI file content, implying a degree of write access or application-controlled template injection that goes beyond simple network access. EPSS data was not provided. KEV status is absent - active exploitation is not confirmed. No POC has been identified. The combination of compile-time gating and the content-control prerequisite means this is a real but conditionally exploitable vulnerability; it should be prioritized in SSI-enabled Mongoose deployments but is not broadly exploitable across all Mongoose users.

An attacker authenticated with low-privilege credentials to a web application backed by SSI-enabled Mongoose uploads or otherwise influences the content of an SSI-served file, embedding a directive such as <!--#include file="../../../etc/shadow" -->. When any HTTP client triggers a request for that file, Mongoose's mg_ssi() constructs the traversal path without sanitization and returns the contents of the target file in the HTTP response, disclosing credentials or configuration data readable by the Mongoose process. No public exploit code has been identified at time of analysis.