CVE-2026-49846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49846
Aliases
  • GHSA-684h-wjm9-2p6j
Published
2026-09-11T21:25:40Z
Modified
2026-09-13T03:30:25Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
libks has path traversal in kws HTTP parser via URI segment overflow
Details

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean_uri() in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-697"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49846.json"
}
References

Affected packages

Git / github.com/signalwire/libks

Affected ranges

Type
GIT
Repo
https://github.com/signalwire/libks
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bae185d56da5b36807b539af0388403e85379305
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.11"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
v1.*
v1.7.0
v1.8.0
v1.8.3
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49846.json"