Arbitrary filepath traversal via URI injection
Priority MEDIUM 49CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.
Why it matters now
EPSS 0.04199 91st percentileScored 2026-11-07
Fix Fixed octorpki (Cloudflare): 1.4.3github.com/cloudflare/cfrpki (Go): 1.4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cloudflare | octorpki | before 1.4.3 | 1.4.3 | Patch available | CNA |
| — | github.com/cloudflare/cfrpki (Go) | before 1.4.4 | 1.4.4 | Patch available | GHSA-cqh2-vc2f-q4fh |
- octorpki VendorCloudflare Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA
- github.com/cloudflare/cfrpki (Go) Vendor— Affected before 1.4.4 Fixed in 1.4.4 Patch available GHSA-cqh2-vc2f-q4fh
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* | before 1.3.0 | Vulnerable | Cloudflare |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
- cpe:2.3:a:cloudflare:octorpki:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Cloudflare
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
Remediation
- Fix · CNA octorpki (Cloudflare) Fixed in 1.4.3
- Fix · GHSA-cqh2-vc2f-q4fh github.com/cloudflare/cfrpki (Go) Fixed in 1.4.4 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Cloudflare octorpki — DSA-5033
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2021-02819 Infinite open connection causes OctoRPKI to hang foreverPriority LOW 36
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3907
- 2026-10-03 Alias added: GHSA-cqh2-vc2f-q4fh
References
Advisory 5
More Cloudflare Octorpki vulnerabilities
- TI-2021-02819 Infinite open connection causes OctoRPKI to hang forever CVSS 3.1HIGH 7.5
- TI-2021-02820 NUL character in ROA causes OctoRPKI to crash CVSS 3.1HIGH 7.5
- TI-2021-02693 OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values CVSS 3.1HIGH 7.5
- TI-2021-02875 Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVSS 3.1HIGH 7.5
- TI-2021-02818 Infinite certificate chain depth results in OctoRPKI running forever CVSS 3.1HIGH 7.5
- TI-2022-03327 OctoRPKI crash when maximum iterations number is reached CVSS 3.1HIGH 7.5
Sources
- CVE-2021-3907 · CVE Program
- CVE-2021-3907 · NVD
- FIRST EPSS
- GHSA-cqh2-vc2f-q4fh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences