CVE-2026-49846

SignalWire's libks support library, prior to version 2.0.11, fails to properly canonicalize HTTP request URIs in its clean_uri() function: when a URI path contains more segments than the internal canonicalization buffer can hold, the function silently passes the URI through with embedded '..' sequences left intact instead of rejecting it. An attacker can send a crafted HTTP request URI containing '..' sequences that, when the consuming application joins the parsed URI with a filesystem path, resolves outside the intended directory. The result is unauthorized file reads (confidentiality impact only, per the CVSS score) in any libks consumer that serves or maps HTTP URIs to the filesystem. Any product built on libks below 2.0.11 that uses its HTTP request parser in this way is affected; exploitation status is currently none known, with no public proof-of-concept and no listing in CISA's KEV.

What to do: Upgrade libks to version 2.0.11 or later and rebuild/redeploy any products that statically or dynamically link it. Audit downstream code paths that join parsed HTTP URIs with filesystem paths (e.g., static file handlers) to confirm they re-validate resolved paths. As an interim mitigation, front libks-based services with a reverse proxy or WAF rule that rejects request URIs containing '..' path segments.