CVE-2026-109118

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109118
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109118.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109118
Published
2026-10-16T10:27:18Z
Modified
2026-10-21T02:54:40Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Details

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

Database specific 
{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109118.json"
}
References

Affected packages

Git / gitlab.com/ikus-soft/rdiffweb

Affected ranges

Type
GIT
Repo
https://gitlab.com/ikus-soft/rdiffweb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
86404d9ea93c2ced96c59be35279525ace1e29d9
Fixed
04b7096566811feb7d782e38560b44044fa91a29
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "7.1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "04b7096566811feb7d782e38560b44044fa91a29"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.10.0
0.10.2
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.7.0
0.8.1
0.9.1
0.9.2
0.9.3
0.9.5
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.3.2
1.4.0
1.5.0
2.*
2.0.0
2.0.1
2.0.2
2.1.0
2.10.4
2.10.5
2.11.0
2.11.0b1
2.11.0b2
2.11.0b3
2.11.0b4
2.11.0b5
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.12.0b1
2.2.1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
7.*
7.0.0
7.0.0a1
7.0.0b1
7.0.0b2
7.0.0b3
7.0.0b5
7.0.0b6
7.0.0b7
7.0.0b8
7.0.1
7.1.0
7.1.0b3
v0.*
v0.6.4
v0.6.5
v0.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109118.json"