CVE-2026-90774: rustypaste before 0.18.1 Path Traversal via filename header

Q: Which deployments are exposed?

rustypaste versions before 0.18.1 are affected. The issue is reachable over the network and does not require attacker privileges or user interaction.

Q: What must an attacker do to exploit this?

The attacker must submit an upload with the optional custom filename HTTP header containing path-traversal sequences. Because the destination path is validated before that header is applied, the traversal can bypass directory-escape checks.

Q: What is the impact of successful exploitation?

An attacker can write uploaded files outside the configured upload directory, potentially to arbitrary filesystem locations. The stated impact is integrity loss; no confidentiality or availability impact is specified.

Q: How can I determine whether a system may be affected?

Check whether the deployed rustypaste version is earlier than 0.18.1 and whether it accepts the optional custom filename HTTP header for uploads. Systems meeting both conditions should be treated as exposed.

Published Sep 13, 2026

Updated

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.

Affected Software

1 affected component

rustypaste<0.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rustypaste to a version that resolves this vulnerability.
Fixed in 0.18.1
Operational
After upgrading to rustypaste 0.18.1, review the filesystem for any files that may have been written outside the configured upload directory via the filename header path traversal, and remove them if present.

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

rustypaste versions before 0.18.1 are affected. The issue is reachable over the network and does not require attacker privileges or user interaction.

What must an attacker do to exploit this?

The attacker must submit an upload with the optional custom filename HTTP header containing path-traversal sequences. Because the destination path is validated before that header is applied, the traversal can bypass directory-escape checks.

What is the impact of successful exploitation?

An attacker can write uploaded files outside the configured upload directory, potentially to arbitrary filesystem locations. The stated impact is integrity loss; no confidentiality or availability impact is specified.

How can I determine whether a system may be affected?

Check whether the deployed rustypaste version is earlier than 0.18.1 and whether it accepts the optional custom filename HTTP header for uploads. Systems meeting both conditions should be treated as exposed.

CVE-2026-90774: rustypaste before 0.18.1 Path Traversal via filename header

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to exploit this?

What is the impact of successful exploitation?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to exploit this?

What is the impact of successful exploitation?

How can I determine whether a system may be affected?