Skip to content
OpenAdvisories
High · 8.3 CVE-2026-49233 EUVD-2026-35063GHSA-33mj-99mg-8g73

Routinator cache path traversal using rogue rsync URIs

Published Jun 8, 2026 · Updated Jun 8, 2026 · Assigned by NLnet Labs

Description

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Affected products

VendorProductAffectedFixed
NLnet Labs Routinator — —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io routinator < 0.15.2 0.15.2 GHSA-33mj-99mg-8g73

References