CVE-2026-28807: Wisp Path Traversal Vulnerability Allows Arbitrary File Read
Summary
CVE-2026-28807: Wisp Vulnerable to Path Traversal. Affects wisp versions >= 2.1.1, < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wisp is a web server framework designed for building applications in the Gleam programming language. It provides functionalities for serving static files, handling requests, and managing application routes. However, a critical vulnerability has been identified in its serve_static function, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from improper sanitization of file paths in the wisp.serve_static function. Specifically, the sanitization process occurs before percent-decoding, allowing an attacker to exploit encoded directory traversal sequences (e.g., %2e%2e) to access files outside the intended directory. This can lead to unauthorized reading of application source code, configuration files, and even sensitive system files, posing a significant security risk.
How To Fix
Minimum fixed version
2.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can copy the fixed implementation from the Wisp GitHub repository and replace references to wisp.serve_static in your codebase. The fixed implementation can be found at: https://github.com/gleam-wisp/wisp/blob/161118c431047f7ef1ff7cabfcc38981877fdd93/src/wisp.gleam#L1413-L1461.
Conclusion
The Wisp framework has a critical path traversal vulnerability that allows unauthorized file access. It is essential to update to the patched version or implement the workaround to protect your application from potential exploitation.
See every vulnerability recorded for wisp →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
An attacker can access application source code, configuration files, secrets, and potentially sensitive system files like /etc/passwd.
No, the vulnerability can be exploited by unauthenticated attackers, making it particularly dangerous.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement the provided workaround to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for wisp.
