CVE-2026-73255

Executive Summary

CVE-2026-73255 is a path traversal vulnerability (CWE-22) in the Mongoose embedded web server and network library, affecting all versions prior to 7.22. An attacker who can control the content of an SSI (Server-Side Includes) enabled file can inject directory traversal sequences into #include or #include virtual directives, allowing the mg_ssi() function in src/ssi.c to concatenate the traversal payload into a filesystem path without sanitization. Because the vulnerable code path omits a call to mg_path_is_sane(), any file readable by the Mongoose process—including configuration files, credentials, or sensitive application data—can be disclosed to the attacker. The vulnerability carries a CVSS score of 6.5 (High confidentiality impact) and is particularly dangerous in deployments where MG_ENABLE_SSI is compiled in and ssi_pattern is configured, as this is a common configuration for embedded devices, IoT appliances, and network equipment.

Technical Analysis

The Mongoose library is a widely deployed embedded web server used in IoT devices, routers, printers, and industrial control systems. Its SSI (Server-Side Includes) feature allows HTML files to dynamically insert content at runtime using directives that reference external files. The NVD description identifies two specific directives as vulnerable: #include file and #include virtual. Both directives accept a file argument that the server resolves relative to the web root.

The flaw resides in the mg_ssi() function located in src/ssi.c. When the SSI parser encounters an #include directive, it takes the argument supplied in the directive and concatenates it directly into a filesystem path that will eventually be opened and returned to the client. The critical missing step is the invocation of mg_path_is_sane() — a function that validates whether a constructed path stays within the intended web root directory. Without this validation, a crafted directive argument such as ../../../../etc/passwd or ..%2f..%2fetc%2fshadow is appended to the base path, and the resulting file is opened and served to the requester.

Key preconditions:

1. MG_ENABLE_SSI must be defined during compilation — this is a build-time flag that enables the SSI subsystem.
2. ssi_pattern must be configured in the Mongoose connection options — this pattern determines which file extensions trigger SSI processing (commonly .shtml, .shtm, or .ssi).
3. The attacker must be able to influence an SSI-enabled file. This can happen through:
   • Uploading a malicious file (if upload functionality exists),
   • Writing to a writable web directory, or
   • Exploiting a template injection or config file flaw elsewhere.

The attack mechanism is fundamentally a classic path traversal flaw, but the unique aspect is the injection vector — server-side includes rather than HTTP request parameters. The attacker does not need to manipulate URL parameters or query strings; instead, they craft the contents of a file that the server itself will later parse and render.

The low attack complexity (AC:L) and user interaction requirements (UI:N) reflect that exploitation requires no special timing, no race conditions, and no user involvement. The privilege requirement (PR:L) reflects that the attacker must have the ability to write an SSI-enabled file, which in many embedded deployments may be achievable through default credentials or an existing lower-privilege foothold. The confidentiality impact is High (C:H) because arbitrary file read can expose credentials, encryption keys, and system internals.

Exploitation Scenarios

Exploitation of CVE-2026-73255 relies on the attacker’s ability to control the contents of an SSI-processed file. The attack chain proceeds as follows:

Step 1: Reconnaissance and Target Identification.
The attacker first identifies a Mongoose-based device or server. Shodan queries for "Mongoose" server headers, embedded web server banners, or common IoT device signatures will reveal candidate targets. The attacker then confirms SSI support by requesting a known SSI extension (e.g., .shtml) and observing whether the response contains dynamic content. Identification of writable upload paths or default administrative interfaces assists in establishing a foothold.

Step 2: Establishing File Write Capability.
The attacker must achieve the ability to write or modify an SSI-enabled file. This may involve:

• Logging into a default administrative interface (many embedded devices ship with unchanged credentials),
• Exploiting a separate file upload vulnerability,
• Leveraging a template management feature that allows editing server-side files.

No public exploit code is available at this time, so this step is the most scenario-dependent. Attack chains are inferred from the vulnerability class.

Step 3: Triggering the Path Traversal via SSI Directive.
Once file write capability is obtained, the attacker creates or modifies an SSI-enabled file (e.g., page.shtml) containing a directive crafted for traversal:

<!--#include file="../../../../etc/shadow" -->

Alternatively:

<!--#include virtual="/../../../../etc/passwd" -->

When the attacker subsequently requests this SSI page over HTTP, the mg_ssi() function parses the directive, concatenates the traversal sequence into a filesystem path, and serves the target file’s contents embedded within the HTTP response.

Step 4: Post-Exploitation Impact.
The immediate impact is unauthorized disclosure of any file readable by the Mongoose process user. On typical embedded systems, this may include:

• /etc/passwd and /etc/shadow (credential files enabling further account compromise),
• Application configuration files containing database credentials or API keys,
• Private keys used for TLS termination (leading to man-in-the-middle attacks),
• Proprietary firmware or application source code.

The accessed data can be leveraged for lateral movement, persistent access, or full device compromise. On network infrastructure devices, this may enable pivoting into the internal network. The exploit does not require the attacker to execute code — simple content disclosure is sufficient for severe damage.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a high confidentiality impact with no integrity or availability impact. The network attack vector means exploitation is remotely possible over HTTP. The low attack complexity and absence of user interaction indicate that exploitation is straightforward once file write capability is established.

Affected systems include all deployments of Mongoose prior to 7.22 with MG_ENABLE_SSI enabled and ssi_pattern configured. This encompasses a broad range of embedded web servers in routers, IP cameras, network storage devices, and industrial controllers. Given the prevalence of Mongoose in the IoT space, the true population of affected devices is likely substantial.

Blast radius: Significant. A single compromise of an SSI-enabled file results in a full file disclosure primitive relative to the Mongoose process’s privileges. On devices running Mongoose as root (a common but poor practice in embedded environments), this equates to complete filesystem disclosure. Even on least-privilege deployments, configuration and credential files frequently reside within the process user’s access scope.

Business impact: High for device manufacturers and operators. Multiplied across enterprise fleets of IoT devices, this vulnerability can expose operational credentials, enable network pivoting, and violate compliance with data protection regulations if customer data is exposed. Unlike a denial-of-service or defacement, a confidentiality breach of this nature is silent and may go undetected for extended periods.

Detection Guidance

Sigma Rule

title: Suspicious SSI Include Directive with Path Traversal Sequences
id: c8f3a2e1-9d7b-4c5e-8a1f-5b6c7d8e9f01
status: experimental
description: Detects HTTP responses containing SSI include directives with directory traversal sequences, indicating potential exploitation of CVE-2026-73255
logsource:
  category: webserver
  product: generic
detection:
  selection_traversal:
    http.response.body|contains|all:
      - '<!--#include'
      - '..'
  selection_directives:
    http.response.body|contains:
      - '#include file="..'
      - '#include virtual="/..'
      - '#include file="..%2f'
      - '#include virtual="/..%2f'
  condition: selection_traversal and selection_directives
level: high
tags:
  - attack.t1190
  - cve.2026.73255
  - cwe.22
falsepositives:
  - Legitimate dynamic includes that reference paths outside web root (rare in correctly configured systems)

YARA Rule

rule CVE_2026_73255_SSI_Path_Traversal {
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects SSI directives with directory traversal sequences used to exploit CVE-2026-73255"
        cve = "CVE-2026-73255"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "<!--#include" ascii nocase
        $s2 = "file=\"" ascii nocase
        $s3 = "virtual=\"" ascii nocase
        $traverse1 = "/../" ascii
        $traverse2 = "\\..\\" ascii
        $traverse3 = "..%2f" ascii nocase
        $traverse4 = "..%5c" ascii nocase
        $traverse5 = "../../" ascii
    condition:
        $s1 and ($s2 or $s3) and ($traverse1 or $traverse2 or $traverse3 or $traverse4 or $traverse5) and filesize < 2MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-73255 - Mongoose SSI Path Traversal Attempt"; flow:to_server,established; content:"<!--#include"; nocase; http.request_body; content:". . /"; http.request_body; distance:0; content:". "; http.request_body; distance:0; pcre:"/<!--#include\s+(file|virtual)\s*=\s*[\x27\x22]\.\./i"; sid:7325501; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026_73255;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.category == "web" and network.protocol == "http"
   and http.request.body.text contains "<!--#include" and 
   (http.request.body.text like "*file=\"..*" or http.request.body.text like "*virtual=\"/..*" or 
    http.request.body.text like "*file=\"..%2f*" or http.request.body.text like "*virtual=\"/..%2f*")]
  [file where event.action in ("open", "read") and 
   file.path like "*..*" and (file.path like "*etc*" or file.path like "*shadow*" or 
   file.path like "*passwd*" or file.path like "*config*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where LIKE(uri, "%.shtml%") OR LIKE(uri, "%.shtm%") OR LIKE(uri, "%.ssi%")
| regex _raw="(?i)#include\\s+(file|virtual)\\s*=\\s*[\"'][^\"']*\\.\\."
| table _time, src_ip, uri, http_method, status, user_agent
| stats count by src_ip, uri, status

# Alternative: Monitor server-side file access events
index=os secure_logs sourcetype=linux_audit
| search type=SYSCALL AND comm=*mongoose* AND (path=*etc* OR path=*shadow* OR path=*passwd*)
| table _time, src_ip, user, path, host

Wazuh OSSEC Rule

<group name="mongoose_ssi,">
  <rule id="732550" level="12">
    <decoded_as>web-access</decoded_as>
    <description>Mongoose SSI file access with path traversal pattern</description>
    <regex>#include\s+(file|virtual)\s*=\s*["'][^"']*\.\.</regex>
    <group>attack.t1190,cve-2026-73255,cwe-22</group>
    <field name="url">\.shtml|\.shtm|\.ssi</field>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1. Immediate mitigations:

   • Disable SSI support entirely if not strictly required by disabling MG_ENABLE_SSI at compile time. For deployments where SSI is compiled into the binary but not used in production content, remove SSI configuration directives or set ssi_pattern to NULL or an empty value.
   • If SSI is required, restrict write access to the web root and SSI-eligible files to trusted administrative processes only. Ensure that any file upload or content management feature disallows writing files with SSI extensions (.shtml, .shtm, .ssi).
   • Implement filesystem-level restrictions using chroot jails, Linux namespaces, or container isolation to limit the files visible to the Mongoose process, even in the event of a successful traversal attack.
   • Run the Mongoose process under a least-privilege user account, not root. This limits the blast radius of arbitrary file read to those files accessible to the non-privileged user.

2. Patch/upgrade steps:

   • Upgrade Mongoose to version 7.22 or later. The claimed fix addresses the missing mg_path_is_sane() call in mg_ssi() and prevents directory traversal sequences from escaping the web root.
   • CRITICAL NOTE: The patch is currently confirmed by a single source (OSV). Until the vendor advisory is published or multiple independent sources validate the fix, treat this as a planned remediation rather than fully confirmed. Monitor vendor channels for official version 7.22 release notes and changelog confirmation.
   • If you cannot immediately upgrade, download and inspect the diff for src/ssi.c in version 7.22 (once publicly available) and consider cherry-picking the fix into your build.

3. Long-term hardening:

   • Adopt a firmware update and vulnerability management program for all embedded devices. Inventory where Mongoose is used within the enterprise and track versions in a CPE-based asset management system.
   • Implement Network Intrusion Prevention System (NIPS) signatures to block SSI requests containing traversal patterns at the network perimeter.
   • Conduct periodic penetration testing of web-facing embedded interfaces, specifically testing SSI injection and path traversal scenarios.
   • For device manufacturers: add a compile-time defensive check that validates all file paths resolved from SSI directives, even after applying upstream patches. Consider defense-in-depth such that SSI paths are canonicalized and validated against an allowlist.
   • Monitor NVD and OSV databases for updates to this CVE, including any changes to EPSS scores or emergence of public exploit code.

References

1. NVD Entry: NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73255 (CVE detail page — check for updated CVSS, references, and CWE enrichment)
2. OSV Advisory: OSV: https://osv.dev/vulnerability/CVE-2026-73255 (single source confirming patch in 7.22)
3. Mongoose Project Website: https://mongoose.ws/ (official source for version 7.22 release and changelog)
4. MITRE ATT&CK: T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ (tactical classification reference)
5. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html (weakness classification reference)

Threat actor activity: No known threat actor campaigns or in-the-wild exploitation evidence has been observed at this time. The EPSS score is not yet assigned by FIRST.org. The lack of public PoC, absence from CISA KEV, and the recent nature of this CVE suggest exploitation is not yet widespread. However, the prevalence of Mongoose in embedded and IoT devices makes opportunistic exploitation highly probable once public exploit details emerge. Analysts should prioritize patching given the low difficulty of converting this flaw into a working exploit.