CVE-2026-28807

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28807
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read. An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files. This issue affects wisp: from 2.1.1 before 2.2.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cna.erlef.org/cves/CVE-2026-28807.html Third Party Advisory
https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93 Patch
https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r Exploit Vendor Advisory Patch
https://osv.dev/vulnerability/EEF-CVE-2026-28807 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*
History

27 May 2026, 13:45

Type Values Removed Values Added
First Time Gleam-wisp
Gleam-wisp wisp
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://cna.erlef.org/cves/CVE-2026-28807.html - () https://cna.erlef.org/cves/CVE-2026-28807.html - Third Party Advisory
References () https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93 - () https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93 - Patch
References () https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r - () https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r - Exploit, Vendor Advisory, Patch
References () https://osv.dev/vulnerability/EEF-CVE-2026-28807 - () https://osv.dev/vulnerability/EEF-CVE-2026-28807 - Third Party Advisory
CPE cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*

06 Apr 2026, 17:17

Type Values Removed Values Added
References
  • () https://cna.erlef.org/cves/CVE-2026-28807.html -
  • () https://osv.dev/vulnerability/EEF-CVE-2026-28807 -

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de Limitación Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en gleam-wisp wisp permite la lectura arbitraria de archivos mediante salto de ruta codificado en porcentaje. La función wisp.serve_static es vulnerable a salto de ruta porque la sanitización se ejecuta antes de la decodificación de porcentaje. La secuencia codificada %2e%2e pasa por string.replace sin cambios, luego uri.percent_decode la convierte a .., que el sistema operativo resuelve como salto de directorio cuando se lee el archivo. Un atacante no autenticado puede leer cualquier archivo legible por el proceso de la aplicación en una única solicitud HTTP, incluyendo código fuente de la aplicación, archivos de configuración, secretos y archivos del sistema. Este problema afecta a wisp: desde 2.1.1 antes de 2.2.1.

10 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 22:16

Updated : 2026-05-27 13:45

NVD link : CVE-2026-28807

Mitre link : CVE-2026-28807

CVE.ORG link : CVE-2026-28807

JSON object : View

Products Affected

gleam-wisp

  • wisp
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')