EIP-2026-118920

PRE-CVE

Mongoose Web Server 2.11 - Directory Traversal

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118920. PoCs published by nitr0us.

AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Mongoose 2.11 on Windows, using encoded sequences to access sensitive files like boot.ini and hosts. The PoC leverages DotDotPwn to fuzz and identify vulnerable paths.

Description

Mongoose Web Server 2.11 - Directory Traversal

Exploits (1)

exploitdb WORKING POC VERIFIED
by nitr0us · textremotewindows
https://www.exploit-db.com/exploits/15373

This exploit demonstrates a directory traversal vulnerability in Mongoose 2.11 on Windows, using encoded sequences to access sensitive files like boot.ini and hosts. The PoC leverages DotDotPwn to fuzz and identify vulnerable paths.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Mongoose 2.11 (Windows Version)
No auth needed
Prerequisites: Network access to the target web server · Mongoose 2.11 running on Windows
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026