CVE-2026-49846: libks has path traversal in kws HTTP parser via URI segment overflow
libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri() in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libksto a version that resolves this vulnerability.Fixed in 2.0.11
Event History
Frequently Asked Questions
Which deployments are exposed to traversal outside an intended directory?
A deployment is exposed if it uses a libks version earlier than 2.0.11 and a consumer takes the parsed URI and joins it with a filesystem path. The issue is in libks's HTTP request parsing and affects URI paths with more segments than the internal canonicalization buffer can hold.
What does an attacker need to exploit this issue?
An attacker needs network access to send an HTTP request containing a URI with enough path segments to overflow the canonicalization buffer and embedded ".." sequences. No authentication or user interaction is required according to the supplied vector.
Are default configurations known to be affected?
The available information does not identify any specific default configuration. Exploitation depends on whether the consuming application later uses the parsed URI when constructing a filesystem path.
What should be done if an immediate upgrade is not possible?
The supplied information does not provide a vendor workaround. As an interim control, avoid using untrusted parsed request URIs to construct filesystem paths unless traversal sequences are reliably rejected or the resolved path is constrained to the intended directory.
How can I determine whether an application may be affected?
Identify libks versions earlier than 2.0.11, then review consumers of its HTTP parser for code that joins request URIs to filesystem paths. Test handling of deeply segmented URI paths containing ".." to determine whether those sequences remain after canonicalization.