GHSA-h7m9-764r-7x4x: Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Q: Which deployments are exposed to this issue?

Deployments using Mongoose before 7.22 are exposed if SSI is enabled with MG_ENABLE_SSI and an ssi_pattern is configured. The impact is limited to files that the Mongoose process can read.

Q: What access does an attacker need to exploit it?

An attacker must be able to control the contents of an SSI-enabled file. They can then use directory-traversal sequences in an #include file or #include virtual directive.

Q: Are default Mongoose deployments affected?

The issue requires SSI support to be enabled and an ssi_pattern to be configured. Deployments without that SSI configuration are not described as affected.

Q: What can be done if upgrading is not immediately possible?

Disable SSI support or prevent untrusted parties from controlling SSI-enabled files and their include directives. Restrict the Mongoose process's filesystem read permissions to reduce the files that could be disclosed.

Q: How can I determine whether an instance is vulnerable?

Check whether the deployed Mongoose version is earlier than 7.22, whether MG_ENABLE_SSI is enabled, and whether ssi_pattern is configured. Also identify whether users or other untrusted inputs can modify SSI-enabled files.

Published Aug 20, 2026

Updated

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mgssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mgpathissane(), allowing an MGENABLESSI deployment with ssipattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.

Affected Software

1 affected component

Cesanta Mongoose<7.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mongoose to a version that resolves this vulnerability.
Fixed in 7.22

Event History

Aug 20, 2026

CVE Published

via OSV·05:40 PM

Data Sourced

via OSV·05:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Mongoose before 7.22 are exposed if SSI is enabled with MG_ENABLE_SSI and an ssi_pattern is configured. The impact is limited to files that the Mongoose process can read.

What access does an attacker need to exploit it?

An attacker must be able to control the contents of an SSI-enabled file. They can then use directory-traversal sequences in an #include file or #include virtual directive.

Are default Mongoose deployments affected?

The issue requires SSI support to be enabled and an ssi_pattern to be configured. Deployments without that SSI configuration are not described as affected.

What can be done if upgrading is not immediately possible?

Disable SSI support or prevent untrusted parties from controlling SSI-enabled files and their include directives. Restrict the Mongoose process's filesystem read permissions to reduce the files that could be disclosed.

How can I determine whether an instance is vulnerable?

Check whether the deployed Mongoose version is earlier than 7.22, whether MG_ENABLE_SSI is enabled, and whether ssi_pattern is configured. Also identify whether users or other untrusted inputs can modify SSI-enabled files.

GHSA-h7m9-764r-7x4x: Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

Are default Mongoose deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an instance is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

Are default Mongoose deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an instance is vulnerable?