{"id":"CVE-2026-109118","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb","summary":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded trave…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-22"],"vendor":"ikus-soft","product":"rdiffweb","affected":["rdiffweb < 7.1.1"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T10:27:18.156Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109118","references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/392"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/393"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/394"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/04b7096566811feb7d782e38560b44044fa91a29"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T11:04:58.139Z","slug":"CVE-2026-109118","body":"## Overview\n\nImproper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed\n\n## Affected\n\n- `rdiffweb < 7.1.1`\n\n## Remediation\n\nUpgrade to 7.2.0","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}