See how rdiffweb compares to other vendors in security performance
Improper Privilege Management in the user management API endpoint (/api/users/{usernameorid}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.
Directory traversal vulnerability in rdwhelpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to the /browse URI.