{"id":"CVE-2026-109118","aliases":["EUVD-2026-102835","GHSA-75v3-2c25-pfq5"],"status":"published","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00229,"percentile":0.1387,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-16T10:27:18Z","modified":"2026-10-28T02:30:37Z","products":[{"vendor":"ikus-soft","product":"rdiffweb"}],"references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb","tags":["package"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/392","tags":["web"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/393","tags":["web"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/394","tags":["web"]},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/04b7096566811feb7d782e38560b44044fa91a29","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109118","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-75v3-2c25-pfq5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109118.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-109118","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","status":"published","published":"2026-10-16T10:27:18.156Z","modified":"2026-10-16T14:11:59.36Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-102835","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","status":"published","published":"2026-10-16T10:27:18Z","modified":"2026-10-16T14:11:59Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:00:06.126239Z"}],"ghsa":[{"id":"GHSA-75v3-2c25-pfq5","title":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause...","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","status":"published","published":"2026-10-16T12:31:22Z","modified":"2026-10-16T12:31:22Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:13:51.12467Z"}],"nvd":[{"id":"CVE-2026-109118","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","status":"published","published":"2026-10-16T11:17:00.793Z","modified":"2026-10-16T20:04:29.76Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-109118","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb","description":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed","status":"published","published":"2026-10-16T10:27:18.156Z","modified":"2026-10-28T02:30:37.841697075Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:55.279797Z"}]}}