PT-2026-24472 · Unknown · Gleam-Wisp Wisp
John Downey
+1
·
Published
2026-03-10
·
Updated
2026-05-27
·
CVE-2026-28807
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
gleam-wisp wisp versions 2.1.1 through 2.2.0
Description
A path traversal issue exists in gleam-wisp wisp that allows arbitrary file reading through percent-encoded path traversal. The
wisp.serve static function is susceptible because sanitization occurs before percent-decoding. The encoded sequence %2e%2e bypasses string replacement and is then converted to .. by uri.percent decode, enabling directory traversal when the file is read. An unauthenticated attacker can read any file accessible to the application process with a single HTTP request, potentially including source code, configuration files, secrets, and system files.Recommendations
Update gleam-wisp wisp to version 2.2.1 or later.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gleam-Wisp Wisp