CVE-2026-73255: Mongoose: Path traversal in SSI #include directives enables arbitrary file read
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mgssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mgpathissane(), allowing an MGENABLESSI deployment with ssipattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.22
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Mongoose before version 7.22 are exposed when SSI is enabled with MG_ENABLE_SSI and ssi_pattern is configured. The disclosed files are limited to those readable by the Mongoose process.
What access does an attacker need to exploit this issue?
An attacker must be able to control the contents of an SSI-enabled file. They can then place directory-traversal sequences in an #include file or #include virtual directive.
How can the issue be remediated?
Upgrade Mongoose to version 7.22, which fixes the issue. If upgrading cannot happen immediately, removing attacker control over SSI-enabled files prevents the described exploitation path.