Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-49846

libks has path traversal in kws HTTP parser via URI segment overflow

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-49846

Published

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-49846

Published

libks

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "signalwire",
                    "product": "libks",
                    "versions": [
                        {
                            "version": "< 2.0.11",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON