CVE-2026-16653 | boazsegev facil.io up to 0.7.58 Public Folder lib/facil/http/http.c http_sendfile2 path traversal (Issue 170)

A vulnerability classified as problematic has been found in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal.

This vulnerability is known as CVE-2026-16653. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.