CVE-2026-28807: Gleam-wisp Wisp path traversal (CVSS 7.5)

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read. An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files. This issue affects wisp: from 2.1.1 before 2.2.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Gleam-wisp Wisp≥ 2.1.1 < 2.2.1

Remediation

Fixed in

Gleam-wisp Wisp≥ 2.2.1

Patch & vendor advisories

References

https://cna.erlef.org/cves/CVE-2026-28807.htmlThird Party Advisory
https://github.com/gleam-wisp/wisp/commit/161118c431047f7ef1ff7cabfcc38981877fdd93Patch
https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8rExploitPatchVendor Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-28807Third Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-28807 being actively exploited?

CVE-2026-28807 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 1.06%.

How severe is CVE-2026-28807?

CVE-2026-28807 has a CVSS 3.1 base score of 7.5, rated high. EPSS estimates a 1.06% probability of exploitation.

Which products are affected by CVE-2026-28807?

Affected products include Gleam-wisp Wisp.

How do I fix CVE-2026-28807?

Upgrade affected software to a fixed version, for example Gleam-wisp Wisp 2.2.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-28807 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo