HIGH

GHSA-33mj-99mg-8g73

Routinator has cache path traversal when processing the module component of rsync URIs

Details

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/routinator

Introduced in: 0Fixed in: 0.15.2

Upgrade routinator to 0.15.2 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2026-49233[ADVISORY]
https://github.com/NLnetLabs/routinator[PACKAGE]
https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2[WEB]
https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt[WEB]