Description
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| orhun | rustypaste | < 0.18.1 | 0.18.1 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- rustypaste < 0.18.1 - Filename Header Path Traversal http/cves/2026/CVE-2026-90774.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- GitHub Issue #622 issue-tracking
- https://github.com/orhun/rustypaste product
- https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs technical-description
- https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8 patch
- VulnCheck Advisory: rustypaste before 0.18.1 Path Traversal via filename header third-party-advisory