CVE-2026-90774 in rustypaste
要約
〜によって MITRE • 2026年09月13日
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.