Vulnerability · Published Sep 11, 2026 · Assigned by GitHub_M

CVE-2026-49846libks has path traversal in kws HTTP parser via URI segment overflow

High 7.5

In plain English

A high-severity path traversal in libks from signalwire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue.

Affected products (as reported)

Vendor	Product	Versions
signalwire	libks	< 2.0.11

Weakness: CWE-22, CWE-697 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/signalwire/libks/security/advisories/GHSA-684h-wjm9-2p6j x_refsource_CONFIRM