Vulnerability · Published Sep 13, 2026 · Assigned by VulnCheck
CVE-2026-90774rustypaste before 0.18.1 Path Traversal via filename header
High 7.5
In plain English
A high-severity path traversal in rustypaste from orhun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 28.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| orhun | rustypaste | 0 – before 0.18.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- GitHub Issue #622 issue-tracking
- https://github.com/orhun/rustypaste product
- https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs technical-description
- https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8 patch
- VulnCheck Advisory: rustypaste before 0.18.1 Path Traversal via filename header third-party-advisory