GitHub Advisoryadvisory · crates.io

GHSA-33mj-99mg-8g73 Routinator has cache path traversal when processing the module component of rsync URIs

HIGH Published 2026-06-08 Modified 2026-06-12 Official page ↗
Aliases
CVE-2026-49233
Ecosystem
crates.io
Packages
routinator
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2026-06-12

Affected packages

• crates.io routinator: < 0.15.2 → fixed in 0.15.2

Description

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Related

Alias · CVE (1)

  • CVE-2026-49233 Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References