EUVD-2026-63499Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the non-default MG_ENABLE_SSI compile-time requirement and the prerequisite that the attacker controls SSI file content; PR:L covers authenticated access; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.
AnalysisAI
Path traversal in Cesanta Mongoose's SSI processing allows an authenticated network attacker to read arbitrary files accessible to the Mongoose process by embedding directory traversal sequences in #include file or #include virtual SSI directives. The mg_ssi() function in src/ssi.c constructs filesystem paths from directive arguments without invoking the existing mg_path_is_sane() validation, bypassing the only guard against traversal. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three simultaneous non-default conditions must be present: (1) Mongoose must be compiled with MG_ENABLE_SSI defined - this is a compile-time opt-in, not enabled in default builds; (2) the ssi_pattern runtime configuration must be set to match files served by the web server; and (3) the attacker must be able to place or influence the content of at least one SSI-enabled file (e.g., via a file upload feature, user-controlled template, or other write-capable application path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5, reflecting network-reachable exploitation requiring low-privilege credentials with high confidentiality impact but no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker authenticated with low-privilege credentials to a web application backed by SSI-enabled Mongoose uploads or otherwise influences the content of an SSI-served file, embedding a directive such as `<!--#include file="../../../etc/shadow" -->`. When any HTTP client triggers a request for that file, Mongoose's mg_ssi() constructs the traversal path without sanitization and returns the contents of the target file in the HTTP response, disclosing credentials or configuration data readable by the Mongoose process. … |
| Remediation | Upgrade to Mongoose 7.22 or later, available at https://github.com/cesanta/mongoose/releases/tag/7.22. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today