Description

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T18:16:46.313Z",
  "pubdate": "2026-08-20T18:16:46.313Z",
  "executiveSummary": "A directory traversal vulnerability exists in the Mongoose embedded web server and network library prior to version 7.22.\nThe vulnerability arises from insufficient input validation within the Server-Side Includes (SSI) handling logic, specifically when processing include directives.\nAn attacker capable of controlling or modifying an SSI-enabled file can inject directory traversal sequences into an #include file or #include virtual directive.\nSuccessful exploitation of this flaw allows unauthorized retrieval of arbitrary files on the underlying filesystem that are readable by the Mongoose process context, leading to sensitive data disclosure.\nThis issue affects deployments utilizing MG_ENABLE_SSI with a configured ssi_pattern.\nThe risk implication is unauthorized information disclosure, potentially exposing system configurations, source code, or sensitive data accessible to the web server process.\nAttack capabilities require the ability to control or influence an SSI-enabled file parsed by the server.\nNo specific authentication or advanced network privileges are explicitly mandated beyond the ability to manipulate the parsed SSI resource.",
  "technicalDetails": "The vulnerability resides in the mg_ssi() function located within src/ssi.c of the Mongoose codebase.\nThe root cause of the vulnerability is the direct concatenation of directive arguments from SSI directives into filesystem paths without validating the resulting path via the mg_path_is_sane() function.\nAffected software versions include all Mongoose versions prior to 7.22 configured with MG_ENABLE_SSI and an active ssi_pattern.\nThe attack flow proceeds as follows: First, an attacker establishes control over an SSI-enabled file parsed by the Mongoose embedded web server. Second, the attacker inserts directory traversal sequences, such as dot-dot-slash patterns, into an #include file or #include virtual directive within the targeted SSI file. Third, when the Mongoose server processes the SSI file, the mg_ssi() function parses the directive argument. Fourth, due to the omission of path sanitization via mg_path_is_sane(), the application concatenates the unsanitized traversal sequences directly into the filesystem path construction string. Fifth, the operating system resolves the traversal path, escaping the intended web root directory. Finally, the Mongoose process reads and discloses the contents of the targeted file back through the HTTP response to the attacker.\nThe vulnerable component is the SSI processing subsystem in src/ssi.c.\nPayload behavior involves traversing out of the web root to arbitrary filesystem locations accessible under the file permissions of the running Mongoose process.\nPost-exploitation impact is limited to unauthorized read access (information disclosure) of files readable by the Mongoose process user."
}