CVE-2026-109118: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ikus060/rdiffwebto a version that resolves this vulnerability.Fixed in 7.2.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have permissions on the sibling path they target. Exploitation also requires user interaction, because the issue is intended to mislead a user into browsing, restoring, viewing history for, or deleting data other than the repository displayed.
What paths can be reached outside the selected repository?
The target must be a sibling path whose name begins with the repository path. A percent-encoded traversal sequence, such as %2e%2e, in the request path can cause affected operations to resolve to that path.
Which operations are affected?
Browse, restore, history, and delete operations are affected. The impact is limited to paths for which the relevant user already has permissions.
How can I identify an affected deployment?
The reported affected version is ikus060 rdiffweb 7.1.1. Review requests to the affected operations for percent-encoded traversal sequences such as %2e%2e, particularly where the resolved path could be a similarly named sibling of the intended repository.