EUVD-2026-76995
GHSA-jcjc-q6x9-fww9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated HTTP upload with no complexity; integrity is High (arbitrary write); no confidentiality or availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
AnalysisAI
Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom filename HTTP header. The flaw is a validation-ordering error in src/paste.rs: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The upload endpoint must be reachable by the attacker over the network, which is the expected deployment posture for a paste/upload service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:N/UI:N/VI:H) accurately reflects a network-accessible, zero-complexity, unauthenticated write-anywhere primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade rustypaste to version 0.18.1 or later, which resolves the issue via commit ac05d552596af4a8429d80f30d11f67117ce02c8 (https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8); see the VulnCheck advisory at https://www.vulncheck.com/advisories/rustypaste-before-0.18.1-path-traversal-via-filename-header for details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of rustypaste deployments across the infrastructure and identify all systems running versions before 0.18.1, prioritizing externally accessible instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today