facil.io Input Validation and Path Traversal Flaws

Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the `http_sendfile2` function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. A public exploit has been released and the vendor has not responded to the responsible disclosure, leaving all known versions unpatched at time of analysis.

Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.