Rustypaste
Monthly
Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom `filename` HTTP header. The flaw is a validation-ordering error in `src/paste.rs`: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. No public exploit has been identified at time of analysis, but the fix commit and GitHub issue make the exact vulnerable code pattern publicly visible, substantially lowering the barrier for reproduction.
Path traversal in rustypaste before 0.18.1 permits unauthenticated remote attackers to write uploaded content to arbitrary filesystem locations by supplying path traversal sequences (e.g., '../../') in the optional custom `filename` HTTP header. The flaw is a validation-ordering error in `src/paste.rs`: the upload destination is validated against the configured upload directory before the attacker-controlled filename header is applied, so the directory-escape check never evaluates the final resolved path. No public exploit has been identified at time of analysis, but the fix commit and GitHub issue make the exact vulnerable code pattern publicly visible, substantially lowering the barrier for reproduction.