rdiffweb CVE-2026-109118

Exploitation requires an authenticated session (PR:L) and depends on the attacker inducing a user to act (UI:R). The specific, concrete preconditions from the description: (1) the request path must contain a percent-encoded traversal sequence (%2e%2e) hitting the browse, restore, history, or delete operation; (2) the target must be a SIBLING path whose directory name begins with the operated repository's path string (so the vulnerable startswith() prefix check passes); and (3) the user must already hold permissions on that sibling repository. Limiting factors: no cross-user privilege boundary is crossed (the user only reaches data they can already access), there is no confidentiality impact, and success hinges on the restrictive sibling-prefix naming condition plus the victim being misled - all of which substantially narrow real-world impact.

This is a genuinely low-priority issue despite being a path traversal (CWE-22), and the signals are internally consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) scores only 4.6 (Medium): it requires an already-authenticated user (PR:L) AND user interaction/being misled (UI:R), with no confidentiality impact (C:N) and only limited integrity/availability impact (I:L/A:L). The description further constrains exploitation to a narrow precondition - the traversal only resolves to a *sibling* path whose name begins with the repository path, and the user must already hold permissions on that sibling - which is closer to AC:H than the AC:L stated in the input (noted as a divergence, not a confirmed error). No EPSS score, KEV listing, POC, or SSVC decision data was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical effect is that an authenticated user can be misled into browsing/restoring/deleting adjacent backup data they already have rights to - an integrity/consistency bug more than a privilege-escalation or data-disclosure threat. Net: a real but low-severity defect, not an urgent patch.

An authenticated rdiffweb user is induced to follow a crafted request path containing a percent-encoded traversal sequence (%2e%2e). Because the server validates containment with a string startswith() check rather than a filesystem boundary check, the browse/restore/history/delete operation resolves onto a sibling repository whose directory name shares the intended repository's prefix, causing the user to unintentionally view or delete data belonging to that other repository. No public exploit code is identified at time of analysis, and exploitation requires authentication plus user interaction.