CVE-2026-109118

CVE-2026-109118 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

CVSS 4.6 · Mittel · EPSS 0,2% · Korrektur verfügbar

Veröffentlicht

2026-10-16T10:27:18.156Z

Aktualisiert

2026-10-16T14:11:59.360Z

Prüfen Sie Ihren Server →