High, CVSS 7.5GoAmendedPublished
esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal
CVE-2026-102657 · GHSA-g3c2-rjq2-c763
- Affected
- Go github.com/esm-dev/esm.sh/web < 0.2.0
- Fixed in
- 0.2.0· Vendor fix available
- Issue
- The documented `web.NewHandler` static file server can read files outside `Config.AppDir` when the request path contains URL-encoded dot-segments such as `%2e%2e`. Go's `ServeMux` redirects plain `/../` paths, but it passes encoded dot-segments to the handler after decoding `r.URL.Path`. The handler then calls `filepath.Join(s.config.AppDir, r.URL.Path)` without checking that the result remains under `AppDir`, allowing unauthenticated arbitrary file reads with the server process privileges. Details `web/README.md:34-40` documents a network-facing setup: ```go http.Handle("GET /", web.NewHandler(web.Config{ AppDir: "/path/to/webapp", Fallback: "/index.html", Dev: false, })) log.Fatal(http.ListenAndServe(":8080", nil)) ``` In `web/handler.go:62-75`, the handler takes `r.URL.Path` and joins it directly with `s.config.AppDir`: ```go pathname := r.URL.Path filename := filepath.Join(s.config.AppDir, pathname) fi, err := os.Lstat(filename) ``` Later the same resolved…
Recommended action: Upgrade to 0.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.