SEPTEMBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-49846

HIGH · CVSS 7.5 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-13

CyberRota Analysis

AI-Generated

The vulnerability affects libks, a foundational component for SignalWire C products, where the `clean_uri()` function in the HTTP request parser fails to properly handle URIs with excessive path segments. This oversight can lead to path traversal attacks, allowing unauthorized access to filesystem paths by exploiting embedded ".." sequences. Organizations utilizing versions prior to 2.0.11 should prioritize patching to mitigate the risk of potential data exposure and system compromise.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49846
Severity
HIGH
CVSS
7.5
EPSS
0.34%

Original NVD Description

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.