PT-2026-41970 · Algernon · Algernon
Dredsen
·
Published
2026-05-19
·
Updated
2026-05-26
·
CVE-2026-45728
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Algernon versions prior to 1.17.7
Description
When Algernon is started with a single file path instead of a directory, the
singleFileMode is enabled, which forcibly activates debugMode. This configuration enables the PrettyError renderer, which discloses the absolute disk path and the complete byte contents of the file that caused a Lua or template error, along with the exception or parser error text. This information is served with an HTTP 200 OK status to any requester.An attacker can trigger this disclosure by provoking a runtime error through common inputs, such as sending an unsupported HTTP method to an endpoint, submitting invalid parameter types that cause a
tonumber() failure, or sending requests missing required headers. This can lead to the exposure of sensitive server-side source code, including database connection strings, API keys, and secrets. Notably, using the --prod flag does not prevent this behavior for non-.lua extensions (such as .po2, .amber, .html, .tmpl, .tl, or .pongo2), as the forced debugMode override takes precedence.Recommendations
Update to version 1.17.7.
As a temporary workaround, avoid invoking the server with a single file path and instead serve content from a directory.
Restrict the use of single-file mode for any environment exposed to untrusted network traffic.
Exploit
Fix
Generation of Error Message Containing Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Algernon