Live › vulnerability › CVE-2026-109118
Go to dashboardrdiffweb 7.1.1 checks repository paths with a plain string prefix comparison, so a percent-encoded traversal sequence can point browse, restore, history and delete operations at a sibling path whose name starts with the repository path. An authenticated user with rights on one repository can act on data outside it, including deleting it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of rdiffweb 7.1.1 with multiple user accounts that hold permissions on repositories where some repository directory names begin with the same string as another path on the server. A single-user instance or one where every user is trusted to act on all repositories is at much lower risk. unknown whether other versions are affected.
No product ranges from the sources yet.
rdiffweb --version or pip show rdiffweb; affected version is 7.1.17.1.1; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
This page as .md · .json · in your agent: get_signal("CVE-2026-109118")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.