CVE-2026-49846 Details
Description
libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.
A path traversal vulnerability has been identified in SignalWire Libks versions prior to 2.0.11. The issue arises in the HTTP request parser's `clean_uri()` function, which fails to properly validate URIs with excessive path segments. This oversight allows embedded '..' sequences to remain intact, potentially leading to unauthorized file access when the URI is later combined with a filesystem path. The vulnerability can be exploited by sending a crafted URI that exceeds the segment limit, effectively bypassing the intended path restrictions.
Users can update to SignalWire Libks version 2.0.11 or later, where this vulnerability has been patched. For FreeSWITCH deployments, ensure that the verto listener is fronted by a reverse proxy that rejects problematic URIs, or configure vhosts to require authentication for file-serving paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/signalwire/libks/security/advisories/GHSA-684h-wjm9-2p6j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-697 | Incorrect Comparison | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libks | <= 2.0.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |