CVE-2026-63644

{
  "etk_id": "ETK-2026-3996",
  "cve_id": "CVE-2026-63644",
  "display_id": "CVE-2026-63644",
  "ghsa_id": "GHSA-3qm5-22pm-wqg9",
  "euvd_id": "EUVD-2026-120457",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal file disclosure in bird-lg-go",
  "summary": "bird-lg-go versions earlier than 1.4.7 are affected by unsafe handling of path input. An unauthenticated remote attacker may be able to read sensitive files from the host when they can reach the affected service.",
  "mitigation": "Upgrade bird-lg-go to version 1.4.7 or later. Restrict network access to the looking-glass service until the update is deployed.",
  "vendor": "xddxdd",
  "product": "bird-lg-go",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.4.6"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.4.7"
      ],
      "package_name": "github.com/xddxdd/bird-lg-go",
      "purl": "pkg:golang/github.com/xddxdd/bird-lg-go"
    }
  ],
  "cwes": [
    88
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 33.887901633333335,
  "t0_at": "2026-11-09T21:22:21.131000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T22:23:47.685490+00:00",
      "days": 0.04266845474537037,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T21:22:21.131000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-07-02T01:28:41+00:00",
      "days": -130.8289367013889,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T21:22:21.131000+00:00",
      "url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-3qm5-22pm-wqg9"
    },
    "trigger_signal": {
      "at": "2026-11-09T21:22:21.131000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T21:22:21.131000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63644"
    }
  }
}