CVE-2026-28807

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read. An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files. This issue affects wisp: from 2.1.1 before 2.2.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-28807.html	Third Party Advisory
https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93	Patch
https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r	Exploit Patch Vendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-28807	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 22:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-28807

Mitre link : CVE-2026-28807

CVE.ORG link : CVE-2026-28807

JSON object : View

Products Affected

gleam-wisp

wisp

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-28807", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28807", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:20:19.768057Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/gleam-wisp/wisp", "vendor": "gleam-wisp", "product": "wisp", "versions": [{"status": "affected", "version": "2.1.1", "lessThan": "2.2.1", "versionType": "semver"}], "packageURL": "pkg:hex/wisp", "packageName": "wisp", "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/gleam-wisp/wisp.git", "vendor": "gleam-wisp", "product": "wisp", "versions": [{"status": "affected", "version": "129dcb1fe10ab1e676145d91477535e1c90ab550", "lessThan": "161118c431047f7ef1ff7cabfcc38981877fdd93", "versionType": "git"}], "packageURL": "pkg:github/gleam-wisp/wisp", "packageName": "gleam-wisp/wisp", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2026-03-10T22:16:18.640", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-28807.html", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93", "tags": ["Patch"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-28807", "tags": ["Third Party Advisory"], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal.\n\nThe wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read.\n\nAn unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files.\n\nThis issue affects wisp: from 2.1.1 before 2.2.1."}, {"lang": "es", "value": "Vulnerabilidad de Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en gleam-wisp wisp permite la lectura arbitraria de archivos mediante salto de ruta codificado en porcentaje.\n\nLa funci\u00f3n wisp.serve_static es vulnerable a salto de ruta porque la sanitizaci\u00f3n se ejecuta antes de la decodificaci\u00f3n de porcentaje. La secuencia codificada %2e%2e pasa por string.replace sin cambios, luego uri.percent_decode la convierte a .., que el sistema operativo resuelve como salto de directorio cuando se lee el archivo.\n\nUn atacante no autenticado puede leer cualquier archivo legible por el proceso de la aplicaci\u00f3n en una \u00fanica solicitud HTTP, incluyendo c\u00f3digo fuente de la aplicaci\u00f3n, archivos de configuraci\u00f3n, secretos y archivos del sistema.\n\nEste problema afecta a wisp: desde 2.1.1 antes de 2.2.1."}], "lastModified": "2026-06-17T10:29:04.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gleam-wisp:wisp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B0D85EE-9736-460F-B08C-3D7B5A676506", "versionEndExcluding": "2.2.1", "versionStartIncluding": "2.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}