CVE-2026-33242

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33242
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33242.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33242
Aliases
Published
2026-03-23T23:40:39.886Z
Modified
2026-04-10T05:42:39.997628Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
Details

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encodeurlpath function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. Version 0.89.3 contains a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33242.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/salvo-rs/salvo

Affected ranges

Type
GIT
Repo
https://github.com/salvo-rs/salvo
Events
Introduced
5b5b9d0abb923f6441138aef0e60365f068eb678
Fixed
f8fb007c4c765dd0a4961f81846e6f27629dcd28
Database specific 
{
    "versions": [
        {
            "introduced": "0.39.0"
        },
        {
            "fixed": "0.89.3"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33242.json"