CVE-2025-11233: Rust standard library didn't detect all path separators on Cygwin
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (x8664-pc-cygwin) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations.
Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target.
While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the x8664-pc-cygwin target you are not affected by this vulnerability. Users of the tier 1 MinGW target (x8664-pc-windows-gnu) are also explicitly not affected.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11233?
CVE-2025-11233 is classified as a medium severity vulnerability due to improper handling of path separators in the Rust Standard Library for Cygwin.
How do I fix CVE-2025-11233?
To fix CVE-2025-11233, upgrade your Rust Standard Library to version 1.89.0 or later.
Which versions of Rust are affected by CVE-2025-11233?
CVE-2025-11233 affects Rust versions from 1.87.0 up to but not including 1.89.0.
What systems are impacted by CVE-2025-11233?
CVE-2025-11233 impacts programs compiled for the Cygwin target using the Rust Standard Library.
Can CVE-2025-11233 lead to data integrity issues?
Yes, CVE-2025-11233 may cause programs to ignore certain path components, potentially leading to data integrity issues.