CVE-2026-90774 in rustypaste
Summary
by MITRE • 09/13/2026
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in rustypaste versions prior to 0.18.1 represents a critical security flaw rooted in improper input validation and order of operations during file handling processes. This issue specifically affects how the application manages user-supplied filenames provided via an optional HTTP header, which is intended to allow users to customize the name of their pasted content. In secure software design, any external input that influences filesystem paths must be rigorously sanitized before being used in system calls or path resolution operations. However, in this specific implementation, the application performs validation checks on the destination path only after attempting to apply the custom filename header. This sequencing error creates a window of opportunity for attackers to exploit the lack of immediate sanitization, leading to a directory traversal vulnerability that compromises the integrity and security of the server's file system.
From a technical perspective, the core flaw lies in the application logic where the destination path is constructed or modified using user-controlled data before strict boundary checks are enforced. When an attacker supplies a filename containing path traversal sequences, such as dot-dot-slash (../) characters, within the HTTP header, these sequences are processed by the underlying file system operations prior to being rejected by validation rules. Because the validation occurs too late in the execution flow, the operating system resolves the relative paths against the current working directory or configured upload root before the application can detect and block the malicious intent. This allows the write operation to succeed outside of the intended sandboxed directory, effectively bypassing the security controls designed to isolate user uploads from critical system files and other sensitive data locations.
The operational impact of this vulnerability is severe, as it enables remote code execution or significant data manipulation depending on what an attacker can write to arbitrary file paths. By writing malicious scripts, configuration files, or symlinks outside the upload directory, an attacker could potentially overwrite existing application binaries, inject web shells into accessible directories, or manipulate critical system configurations. This level of access undermines the fundamental principle of least privilege and isolation that should exist between user-generated content storage and the rest of the server environment. If rustypaste is deployed in a public-facing manner without additional network-level protections, this flaw could lead to complete compromise of the underlying host machine, resulting in data exfiltration, service disruption, or further lateral movement within the internal network infrastructure.
This vulnerability aligns with Common Weakness Enumeration (CWE) ID 22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize special elements such as ../ that can resolve to a parent directory. Furthermore, in terms of the MITRE ATT&CK framework, this exploit technique corresponds to T1083: File and Directory Discovery combined with T1564: Hidden Files and Directories if used for persistence, or more broadly under Initial Access techniques involving web application attacks where file upload mechanisms are abused. The lack of early validation is a classic example of CWE 20: Improper Input Validation, highlighting the necessity of validating all inputs at the earliest possible point in the processing pipeline to prevent such bypasses.
To mitigate this vulnerability and similar risks in future versions or related applications, developers must implement strict input sanitization immediately upon receipt of any user-supplied data that influences filesystem paths. This involves rejecting filenames containing path traversal sequences like ../ or ..\ before they are processed by file system APIs. Additionally, implementing canonicalization checks to resolve the full absolute path and verifying it remains within an allowed base directory is essential for robust defense in depth. For organizations currently running affected versions of rustypaste, immediate upgrading to version 0.18.1 or later is required as this release addresses the ordering flaw by ensuring proper validation precedes file operations. Until upgrades are applied, deploying a Web Application Firewall (WAF) with rules specifically targeting path traversal attempts in HTTP headers can provide an additional layer of protection against exploitation of this specific weakness.