← Back to CVE List
CVE-2026-90774NVD
Description
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
CVSS Base Metrics
CVSS v3 (3.1)
HIGH 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4 (4.0)
HIGH 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses (CWE)
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected & Patched Versions
| Product | Affected Versions | Patched Version |
|---|---|---|
| orhun rustypaste | 0 - < 0.18.1 | N/A |
References
- https://github.com/orhun/rustypaste/issues/622
- https://github.com/orhun/rustypaste
- https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs
- https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8
- https://www.vulncheck.com/advisories/rustypaste-before-0.18.1-path-traversal-via-filename-header