CVE-2026-109118 in Rdiffweb
Summary
by MITRE • 10/16/2026
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in ikus060 rdiffweb version 7.1.1 represents a critical directory traversal flaw rooted in improper input validation and path containment logic. This security defect allows an authenticated attacker to manipulate file system operations such as browsing, restoring, viewing history, or deleting files by exploiting the application's handling of URL-encoded characters within request paths. Specifically, the vulnerability arises because the software utilizes a naive string prefix comparison method, typically implemented via functions like startswith in Python-based applications, to verify that user-supplied input remains within the designated repository directory. This approach fails to account for path normalization or canonicalization before performing the containment check. Consequently, an attacker can inject percent-encoded traversal sequences, such as %2e%2e which decodes to .. (dot-dot), into the request URI. Because the validation occurs on the raw, un-normalized string, the application incorrectly determines that the requested path is still within the allowed directory boundary, even though the actual resolved file system path points outside of it.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as Directory Traversal or Path Traversal. The core issue lies in the failure to resolve symbolic links and normalize paths before applying security constraints. In many web frameworks, path segments containing encoded dots are not automatically converted into their literal counterparts during initial validation phases if the developer assumes that string matching is sufficient for security boundaries. This oversight creates a discrepancy between the logical view of the directory structure presented by the application and the actual physical location on the disk where data resides. The vulnerability specifically targets operations that interact with the file system, meaning it poses a direct risk to data integrity and availability rather than just confidentiality.
The operational impact of this vulnerability is significant for organizations relying on rdiffweb for backup management and restoration tasks. An authenticated user who exploits this flaw can access files located in sibling directories or other parts of the server's file system that share a common prefix with the target repository path. For instance, if a repository is named repo_data, an attacker might traverse to ../repo_data_sensitive by using encoded traversal sequences, provided they have permissions on those sibling paths. This capability allows the user to browse sensitive configuration files, read private data from other projects, or potentially delete critical system files if deletion operations are exposed through this interface. The ability to mislead users into operating on unintended targets undermines the trust in backup integrity and can lead to accidental destruction of important historical data that was not intended for modification by the current user session.
This vulnerability also maps directly to MITRE ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to enumerate and access files outside their authorized scope. Furthermore, if the deletion functionality is exploited, it falls under T1485: Data Destruction. The severity of the impact is heavily dependent on the underlying file system permissions assigned to the web application process. If the service runs with elevated privileges or broad read/write access across multiple directories, the potential for data exfiltration and sabotage increases substantially. Even in restricted environments, the ability to view files outside the intended scope constitutes a serious breach of confidentiality principles within the context of backup management tools.
To mitigate this vulnerability, developers must implement robust path canonicalization before performing any containment checks. This involves resolving all symbolic links and normalizing relative paths using standard library functions that handle dot-dot sequences correctly, ensuring that ../ is resolved to its absolute parent directory rather than treated as a literal string segment. The validation logic should compare the normalized, real file system path against the allowed base directory, rather than relying on substring matching of user-supplied input. Additionally, implementing strict allow-listing for permitted characters in paths and rejecting any request containing encoded traversal sequences can provide an additional layer of defense. Upgrading to a patched version that addresses this logic error is essential, alongside reviewing file system permissions to ensure the application operates with the principle of least privilege, limiting its access strictly to the necessary repository directories.