CVE-2026-52792
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-52792 is a high-severity Improper Handling of Windows ::DATA Alternate Data Stream (CWE-69) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Fileless Storage (T1027.011); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-62506
Vulnerability Data
Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append…
more
one of these suffixes to a public server-side script using the .lua, .tl, .po2, .amber, or .frm extension. The request path passes through URL2filename in utils/files.go, skips the renderer and execution cases, and reaches FilePage, os.Open, ReadAndLogErrors, and ToClient, while NTFS resolves the alias to the underlying script. The server consequently returns raw script source and can expose database credentials, API keys, and the SetCookieSecret value, which may permit forged session cookies. Linux and macOS hosts are not affected by this issue. This issue is fixed in version 1.17.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement that recognizes all NTFS file access methods will block unauthorized use of ::$DATA streams.
Information-flow rules applied at the file-system level can treat ADS contents as distinct flows that must be authorized.
Review of file-access audit records can reveal creation or use of alternate data streams after the fact.
System monitoring configured to watch for ADS-specific file operations can surface hidden-stream activity.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring of runtime data and file activity directly detects or blocks hidden ADS usage.
Behavioral monitoring of technology usage may surface ADS anomalies as side effects.
Execution restrictions can block ADS-hidden binaries but do not address non-executable data streams.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging of file-system events can record ADS access attempts, aiding detection, but does not prevent the weakness itself.
Monitoring activities can flag anomalous ADS usage, providing partial mitigation through detection rather than prevention.
Secure-coding standards and reviews can require explicit handling or disabling of alternate data streams, directly addressing the root cause in application code.
Access-control rules can restrict which users or processes may read or write alternate data streams, but do not inherently detect or block ADS misuse.
Malware-protection mechanisms may scan or block known ADS-based threats, yet coverage is limited to signature or behavior heuristics rather than all ADS handling flaws.
Vulnerability-management processes can identify and patch OS or application weaknesses that permit ADS abuse, but do not directly address improper ADS handling in custom code.