rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks.
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.01358·Published 2026-09-13·Fixed in 0.18.1CWE-22