CVE-2026-16653 in facil.io
Summary
by MITRE • 07/23/2026
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/23/2026
The security vulnerability identified in boazsegev facil.io version 0.7.58 and earlier represents a critical path traversal flaw within the HTTP server implementation. This vulnerability resides in the http_sendfile2 function located in lib/facil/http/http.c, which serves as the core component responsible for handling public folder requests. The flaw stems from inadequate input validation and sanitization of file paths when processing HTTP requests for static content delivery. When an attacker crafts malicious requests containing directory traversal sequences such as ../ or ..\, the application fails to properly validate these inputs before attempting to serve files from the filesystem. This allows adversaries to access files outside the intended document root directory, potentially exposing sensitive system information, configuration files, or other restricted resources that should remain inaccessible to unauthorized users.
The technical exploitation of this vulnerability follows a well-established pattern consistent with CWE-22 Path Traversal attacks, where insufficient restrictions on user-supplied input data enable attackers to manipulate file access operations. The flaw operates at the application layer and can be exploited remotely without requiring authentication or special privileges. Attackers can leverage this vulnerability by sending specially crafted HTTP requests that include traversal sequences in the requested resource paths. The exploitation process typically involves constructing malicious URLs that reference files outside the intended web root, potentially leading to information disclosure, system compromise, or denial of service conditions. This vulnerability directly maps to ATT&CK technique T1083 (File and Directory Discovery) and T1566 (Phishing with Malicious Attachments) when combined with other attack vectors.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can provide attackers with access to critical system resources that may contain sensitive data or configuration parameters. Remote exploitation capabilities mean that attackers can target vulnerable systems from anywhere on the internet without requiring physical access or prior authentication. The fact that public exploits have been released increases the risk profile significantly, as automated attack tools can be readily deployed against exposed instances. Organizations running affected versions of facil.io are particularly vulnerable since the flaw exists in the core HTTP handling functionality and affects all public folder requests regardless of the specific content being served.
Mitigation strategies should focus on immediate patching of the affected software to version 0.7.59 or later, which contains the necessary fixes for the path traversal vulnerability. In the interim, administrators can implement additional protective measures such as input validation at the application level, restricting access to sensitive directories through proper file system permissions, and implementing web application firewalls that can detect and block malicious traversal sequences. Network-level protections including intrusion detection systems and firewall rules can help prevent exploitation attempts by monitoring for suspicious HTTP request patterns containing directory traversal sequences. Regular security audits and vulnerability assessments should be conducted to identify similar flaws in other components of the software stack. The vulnerability also highlights the importance of maintaining up-to-date dependencies and following secure coding practices that include proper input validation and sanitization to prevent similar issues from occurring in future implementations.