CVE-2026-109118

CVE-2026-109118 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

CVSS 4.6 · Medium · EPSS 0.2% · Fix available

Published

2026-10-16T10:27:18.156Z

Updated

2026-10-16T14:11:59.360Z

Check your server →