CVE-2026-53779: WebP Server Go Path Traversal on Windows

Technical summary

The vulnerability resides in handler/router.go where path.Clean() sanitization fails to account for percent-encoded backslashes (%5C). Go's path.Clean() normalizes only forward slashes, leaving Windows-encoded backslashes unprocessed. When the request reaches Windows file system APIs, both backslashes and forward slashes are treated as path separators, allowing traversal beyond IMG_PATH boundaries. An unauthenticated remote attacker can send requests with %5C sequences to navigate the directory tree and read sensitive files accessible to the server process without authentication or user interaction.

Business impact

Unauthorized file disclosure poses a significant confidentiality risk. Attackers can extract sensitive configuration files, credentials, private keys, or application data stored on the server. For organizations using WebP Server Go to serve images from restricted directories, this creates a data breach vector. The severity is heightened if the server runs with elevated privileges or has access to sensitive system files. Remediation delay increases exposure window for opportunistic reconnaissance and data theft.

Affected systems

WebP Server Go version 0.14.4 and earlier on Windows platforms. The vulnerability does not affect Linux or other Unix-like systems where backslash is a valid filename character rather than a path separator. Organizations running WebP Server Go on Windows infrastructure are directly at risk; those on Linux/Unix distributions are unaffected by this specific issue.

Exploitability

Exploitation is straightforward and requires no authentication, no user interaction, and no special privileges. An attacker needs only network access to the WebP Server Go instance and knowledge of the server's existence. The attack surface is the standard HTTP request mechanism. No advanced techniques or complex prerequisites are needed, making this vulnerability immediately exploitable by even unsophisticated threat actors. The attack is remotely triggerable over the network.

Remediation

Upgrade WebP Server Go to a version newer than 0.14.4 that implements proper path traversal defenses. Verify against the vendor's advisory for the specific patched version. Temporary mitigations pending patching include restricting network access to the WebP Server Go instance via firewall rules, running the process with minimal file system permissions, or disabling the service until a patch is available. After patching, verify that percent-encoded backslashes no longer allow directory traversal in test requests.

Patch guidance

Check the official WebP Server Go repository and release notes for versions released after 0.14.4. Apply the patched version according to your deployment method (binary update, container image, or source rebuild). Test the patched version in a non-production environment first to ensure compatibility. Verify the fix by attempting exploitation vectors with %5C-encoded requests—these should now be properly sanitized or rejected. Monitor vendor advisories for confirmation that this specific bypass has been closed.

Detection guidance

Monitor HTTP access logs for requests containing %5C (percent-encoded backslash) patterns, particularly those targeting paths above the configured IMG_PATH directory or accessing known sensitive files (e.g., config files, system paths). Implement Web Application Firewall (WAF) rules to block requests with encoded backslashes or suspicious path traversal sequences. Set up file integrity monitoring on sensitive files to detect unauthorized reads. Review access logs for successful HTTP 200 responses to requests with traversal patterns. Correlate WebP Server Go access logs with file system access audit logs to identify suspicious read activity.

Why prioritize this

This vulnerability merits prompt patching due to its HIGH CVSS score (7.5), network exploitability, lack of authentication requirement, and direct confidentiality impact. Although not yet on the KEV catalog, the ease of exploitation and potential for credential disclosure or sensitive data exfiltration make this a priority for Windows-based deployments. Organizations should prioritize patching WebP Server Go instances accessible from untrusted networks.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity vulnerability driven by network accessibility (AV:N), low attack complexity (AC:L), no privilege or user interaction requirements (PR:N/UI:N), and high confidentiality impact (C:H). The vulnerability does not enable integrity or availability attacks, capping the score. The risk is elevated in practice for environments where WebP Server Go has access to sensitive files or runs on systems with broader file system exposure.

Frequently asked questions