---
id: "CVE-2026-109118"
kind: "vulnerability"
aliases: ["CVE-2026-109118"]
title: "rdiffweb: path check lets authenticated users reach sibling directories"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "python", "rdiffweb", "self-hosted"]
not_affected_if: ["auth-required", "single-user"]
published_at: "2026-10-16T11:17:00+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:35:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109118", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# rdiffweb: path check lets authenticated users reach sibling directories

rdiffweb 7.1.1 checks repository paths with a plain string prefix comparison, so a percent-encoded traversal sequence can point browse, restore, history and delete operations at a sibling path whose name starts with the repository path. An authenticated user with rights on one repository can act on data outside it, including deleting it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed rdiffweb version with `rdiffweb --version` or `pip show rdiffweb`; affected version is `7.1.1`
- Confirm whether users with access to one repository also have access to sibling directories whose names share its prefix

## Fix

- Upgrade rdiffweb past `7.1.1`; the fixed version is unknown from the sources
- Until patched, limit user accounts to trusted users and restrict repository directory names so no repository name is a prefix of another

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109118

## From the sources

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_