GHSA-33mj-99mg-8g73

Source

https://github.com/advisories/GHSA-33mj-99mg-8g73

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-33mj-99mg-8g73/GHSA-33mj-99mg-8g73.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33mj-99mg-8g73

Aliases

CVE-2026-49233

Published

2026-06-08T15:33:00Z

Modified

2026-06-12T19:26:26Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Routinator has cache path traversal when processing the module component of rsync URIs

Details

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-12T19:06:10Z",
    "nvd_published_at":  "2026-06-08T15:16:47Z",
    "severity":  "HIGH"
}

References

Affected packages

crates.io / routinator

Package

Name: routinator; View open source insights on deps.dev
Purl: pkg:cargo/routinator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.15.2

Database specific

last_known_affected_version_range

"<= 0.15.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-33mj-99mg-8g73/GHSA-33mj-99mg-8g73.json"