CVE-2026-73255 in Mongoose
Summary
by MITRE • 08/20/2026
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Mongoose serves as a widely utilized embedded web server and network library, designed for resource-constrained environments such as IoT devices and microcontrollers. A critical security flaw was identified within its Server-Side Includes (SSI) processing functionality prior to version 7.22. The vulnerability stems from the implementation of the mg_ssi function located in src/ssi.c, which is responsible for parsing SSI directives embedded within web content files. When an administrator or developer configures Mongoose with MG_ENABLE_SSI enabled and defines a specific ssi_pattern, the server processes these directives to dynamically include file contents into responses. The core technical flaw lies in how the library handles path resolution during this inclusion process. Specifically, when processing #include file or #include virtual directives, the mg_ssi function concatenates the user-supplied directive argument directly into a filesystem path without performing adequate sanitization or validation checks against directory traversal sequences.
This lack of input validation allows an attacker who has control over any SSI-enabled file to inject malicious directory traversal characters, such as ../, into the include directives. By carefully crafting these paths, the attacker can manipulate the resulting filesystem lookup to escape the intended web root directory and access arbitrary files on the underlying operating system that are readable by the user account running the Mongoose process. This behavior represents a classic path traversal vulnerability, formally categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The absence of a call to mg_path_is_sane(), which is designed to verify that resolved paths remain within safe boundaries, creates an exploitable gap in the server's security model. Consequently, this flaw enables unauthorized information disclosure, allowing attackers to read sensitive configuration files, source code, or other private data stored on the host system.
The operational impact of this vulnerability is significant for any deployment relying on SSI features without strict access controls. Attackers can leverage this weakness to exfiltrate confidential data, potentially leading to further compromise if such data includes credentials or internal network topology information. This type of attack aligns with techniques described in the MITRE ATT&CK framework under T1083: File and Directory Discovery, where adversaries seek to enumerate files and directories on a compromised system. The severity is heightened by the fact that Mongoose is often deployed in embedded systems where security mechanisms may be less robust than those found in traditional server environments, making data leakage particularly damaging.
To mitigate this vulnerability, organizations must immediately upgrade their Mongoose installations to version 7.22 or later, which includes patches for the mg_ssi function and ensures proper path validation is performed before file inclusion. For deployments that cannot be upgraded instantly, administrators should disable SSI processing entirely by ensuring MG_ENABLE_SSI is not defined during compilation if dynamic content inclusion is not strictly required. If SSI must remain enabled, it is critical to restrict access to only those files within a tightly controlled directory structure and avoid allowing user input to influence file paths directly. Regular security audits of embedded web server configurations are recommended to ensure that path traversal protections are consistently applied across all active features.