Read the docs
TI-2026-75262 Aliases CVE-2026-109118GHSA-75v3-2c25-pfq5

Path traversal in rdiffweb lets users operate on sibling paths

Priority LOW 21CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The rdiffweb package from ikus-soft before 7.1.1 is affected. A string prefix check instead of a path boundary check (CWE-22) lets a percent-encoded traversal resolve to a sibling path. An authenticated user with permissions on that sibling can make browse, restore, history and delete act on data outside the displayed repository, misleading them into deleting other data.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed rdiffweb (ikus-soft): 7.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ikus060rdiffwebbefore 7.1.17.1.1Patch availableCNA
  • rdiffweb Vendorikus060 Affected before 7.1.1 Fixed in 7.1.1 Patch available CNA

Remediation

Upgrade ikus-soft rdiffweb to version 7.1.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA rdiffweb (ikus-soft) Fixed in 7.1.1

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-109118
  2. 2026-10-16 Alias added: GHSA-75v3-2c25-pfq5

References

Other 5

  • TI-2022-03176 Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
  • TI-2022-03107 Insufficient Session Expiration in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
  • TI-2022-04320 Improper Access Control in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
  • TI-2022-04315 Business Logic Errors in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
  • TI-2022-03952 Improper Privilege Management in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
  • TI-2022-03191 Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb CVSS 3.1CRITICAL 9.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences