CVE-2026-109118

CVE-2026-109118 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

CVSS 4.6 · Media · EPSS 0,2% · Corrección disponible

Publicación

2026-10-16T10:27:18.156Z

Actualización

2026-10-16T14:11:59.360Z

Comprueba tu servidor →