EUVD-2025-33229

| CVE-2025-11233 MEDIUM
2025-10-01 986d4109-89ea-491f-99fd-a8e4803919bd
6.3
CVSS 4.0
Share

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/RE:L/U:Green
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None

Lifecycle Timeline

4
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 13, 2026 - 18:18 euvd
EUVD-2025-33229
Analysis Generated
Mar 13, 2026 - 18:18 vuln.today
CVE Published
Oct 01, 2025 - 17:15 nvd
MEDIUM 6.3

Tags

Path Traversal Ubuntu Debian Redhat Suse Windows

Description

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.

Analysis

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (x86_64-pc-cygwin) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations.

Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target.

While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the x86_64-pc-cygwin target you are not affected by this vulnerability. Users of the tier 1 MinGW target (x86_64-pc-windows-gnu) are also explicitly not affected.

Technical Context

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

Remediation

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: +0.2
CVSS: +32
POC: 0

Vendor Status

Ubuntu

Priority: Low
rustc
Release Status Version
plucky DNE -
bionic not-affected 1.87+ only
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
trusty not-affected 1.87+ only
upstream not-affected 1.87+ only
xenial not-affected 1.87+ only
questing DNE -
rustc-1.62
Release Status Version
noble DNE -
plucky DNE -
jammy not-affected 1.87+ only
questing DNE -
upstream not-affected 1.87+ only
rustc-1.74
Release Status Version
jammy DNE -
plucky DNE -
questing DNE -
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.76
Release Status Version
plucky DNE -
questing DNE -
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.77
Release Status Version
plucky DNE -
questing DNE -
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.78
Release Status Version
plucky DNE -
questing DNE -
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.79
Release Status Version
plucky DNE -
questing DNE -
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.80
Release Status Version
plucky DNE -
questing DNE -
focal not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
upstream not-affected 1.87+ only
rustc-1.88
Release Status Version
jammy DNE -
noble DNE -
plucky DNE -
upstream needs-triage -
questing needs-triage -
rustc-1.81
Release Status Version
jammy not-affected 1.87+ only
questing DNE -
noble not-affected 1.87+ only
plucky ignored end of life, was not-affected (1.87+ only)
upstream not-affected 1.87+ only
rustc-1.82
Release Status Version
jammy not-affected 1.87+ only
questing DNE -
noble not-affected 1.87+ only
plucky ignored end of life, was not-affected (1.87+ only)
upstream not-affected 1.87+ only
rustc-1.83
Release Status Version
questing DNE -
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
plucky ignored end of life, was not-affected (1.87+ only)
upstream not-affected 1.87+ only
rustc-1.84
Release Status Version
questing DNE -
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
plucky ignored end of life, was not-affected (1.87+ only)
upstream not-affected 1.87+ only
rustc-1.85
Release Status Version
questing not-affected 1.87+ only
jammy not-affected 1.87+ only
noble not-affected 1.87+ only
plucky ignored end of life, was not-affected (1.87+ only)
upstream not-affected 1.87+ only

Debian

rustc
Release Status Fixed Version Urgency
bullseye not-affected - -
bookworm not-affected - -
trixie not-affected - -
forky fixed 1.91.1+dfsg1-1 -
sid fixed 1.92.0+dfsg1-1 -
(unstable) fixed 1.89.0+dfsg1-1 -

Share

EUVD-2025-33229 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy