CVE-2026-16653
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-23 02:16:27.720000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-16653",
"sourceIdentifier": "[email protected]",
"published": "2026-07-23T02:16:27.720",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Se ha descubierto una falla de seguridad en boazsegev facil.io hasta la versión 0.7.58. Esto afecta a la función http_sendfile2 del archivo lib/facil/http/http.c del componente Gestor de Carpeta Pública. Realizar una manipulación resulta en salto de ruta. Es posible la explotación remota del ataque. El exploit ha sido publicado y puede ser utilizado para ataques. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "boazsegev",
"product": "facil.io",
"cpes": [
"cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:*"
],
"modules": [
"Public Folder Handler"
],
"versions": [
{
"version": "0.7.0",
"status": "affected"
},
{
"version": "0.7.1",
"status": "affected"
},
{
"version": "0.7.2",
"status": "affected"
},
{
"version": "0.7.3",
"status": "affected"
},
{
"version": "0.7.4",
"status": "affected"
},
{
"version": "0.7.5",
"status": "affected"
},
{
"version": "0.7.6",
"status": "affected"
},
{
"version": "0.7.7",
"status": "affected"
},
{
"version": "0.7.8",
"status": "affected"
},
{
"version": "0.7.9",
"status": "affected"
},
{
"version": "0.7.10",
"status": "affected"
},
{
"version": "0.7.11",
"status": "affected"
},
{
"version": "0.7.12",
"status": "affected"
},
{
"version": "0.7.13",
"status": "affected"
},
{
"version": "0.7.14",
"status": "affected"
},
{
"version": "0.7.15",
"status": "affected"
},
{
"version": "0.7.16",
"status": "affected"
},
{
"version": "0.7.17",
"status": "affected"
},
{
"version": "0.7.18",
"status": "affected"
},
{
"version": "0.7.19",
"status": "affected"
},
{
"version": "0.7.20",
"status": "affected"
},
{
"version": "0.7.21",
"status": "affected"
},
{
"version": "0.7.22",
"status": "affected"
},
{
"version": "0.7.23",
"status": "affected"
},
{
"version": "0.7.24",
"status": "affected"
},
{
"version": "0.7.25",
"status": "affected"
},
{
"version": "0.7.26",
"status": "affected"
},
{
"version": "0.7.27",
"status": "affected"
},
{
"version": "0.7.28",
"status": "affected"
},
{
"version": "0.7.29",
"status": "affected"
},
{
"version": "0.7.30",
"status": "affected"
},
{
"version": "0.7.31",
"status": "affected"
},
{
"version": "0.7.32",
"status": "affected"
},
{
"version": "0.7.33",
"status": "affected"
},
{
"version": "0.7.34",
"status": "affected"
},
{
"version": "0.7.35",
"status": "affected"
},
{
"version": "0.7.36",
"status": "affected"
},
{
"version": "0.7.37",
"status": "affected"
},
{
"version": "0.7.38",
"status": "affected"
},
{
"version": "0.7.39",
"status": "affected"
},
{
"version": "0.7.40",
"status": "affected"
},
{
"version": "0.7.41",
"status": "affected"
},
{
"version": "0.7.42",
"status": "affected"
},
{
"version": "0.7.43",
"status": "affected"
},
{
"version": "0.7.44",
"status": "affected"
},
{
"version": "0.7.45",
"status": "affected"
},
{
"version": "0.7.46",
"status": "affected"
},
{
"version": "0.7.47",
"status": "affected"
},
{
"version": "0.7.48",
"status": "affected"
},
{
"version": "0.7.49",
"status": "affected"
},
{
"version": "0.7.50",
"status": "affected"
},
{
"version": "0.7.51",
"status": "affected"
},
{
"version": "0.7.52",
"status": "affected"
},
{
"version": "0.7.53",
"status": "affected"
},
{
"version": "0.7.54",
"status": "affected"
},
{
"version": "0.7.55",
"status": "affected"
},
{
"version": "0.7.56",
"status": "affected"
},
{
"version": "0.7.57",
"status": "affected"
},
{
"version": "0.7.58",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-23T16:06:02.664773Z",
"id": "CVE-2026-16653",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://github.com/boazsegev/facil.io/",
"source": "[email protected]"
},
{
"url": "https://github.com/boazsegev/facil.io/issues/170",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-16653",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/860587",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/382396",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/382396/cti",
"source": "[email protected]"
}
]
}