Description
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
orhun rustypaste
Default version status: unaffected
0 to < 0.18.1affected
pkg:cargo/rustypasteReferences
- https://github.com/orhun/rustypaste/issues/622 ↗
- https://github.com/orhun/rustypaste ↗
- https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs ↗
- https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8 ↗
- https://www.vulncheck.com/advisories/rustypaste-before-0.18.1-path-traversal-via-filename-header ↗