CVE-2026-73255 is a path traversal vulnerability in Mongoose's SSI handler (the mg_ssi() function). The handler processes #include virtual directives by concatenating user-supplied paths without validation, allowing attackers to read arbitrary files on the filesystem accessible to the mongoose process. The vulnerability is exploitable through any HTTP endpoint that enables SSI and passes untrusted input to the #include virtual directive.
Version 7.22 contains the fix, which wires the existing mg_path_is_sane() validation function into the SSI handler's path construction logic. This is the concrete change to verify: inspect the diff for the SSI handler and confirm a path validation call now precedes any filesystem operation.
A critical misconception to correct: the ssi_pattern configuration option does not protect against this vulnerability. It performs extension matching on the constructed path after concatenation occurs — the path traversal happens first. Configuring ssi_pattern to restrict .html files creates a false sense of security while the underlying path construction remains exploitable. Do not rely on this configuration as a mitigating control.
If you embed Mongoose in your application, the blast radius extends beyond the web server process. An attacker exploiting this vulnerability reads files as whatever user your application runs as — that means API keys, database credentials, configuration secrets, and application data are all accessible. Treat any file readable by the mongoose process as potentially exposed if SSI is enabled and external input reaches the #include virtual directive.
Beyond patching to 7.22, audit your codebase for other call sites that handle user-controlled paths. The existence of mg_path_is_sane() without mandatory enforcement created a gap that this CVE exploited. Search for similar patterns: string concatenation or sprintf operations on external input that construct filesystem paths without calling the validator. The fix closed one gap, but the architectural pattern that allowed it — security utilities as optional rather than enforced — likely exists elsewhere in the codebase.