https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T07:36:05.998871+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-183596 EUVD-2026-183596 2026-10-25T07:36:06.002637+00:00 EUVD-2026-183596 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3907 fkie_cve-2021-3907 2026-10-25T07:36:06.002667+00:00

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.

 https://cve.radiocsirt.org/vuln/ghsa-3jhm-87m6-x959 GHSA-3jhm-87m6-x959 — Path traversal mitigation bypass in OctoRPKI 2026-10-25T07:36:06.002698+00:00

Affected: Go: github.com/cloudflare/cfrpki

### Impact The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.

### Specific Go Packages Affected github.com/cloudflare/cfrpki/cmd/octorpki

### Patches The issue was fixed in version 1.4.3

### References [CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)

 https://cve.radiocsirt.org/vuln/gsd-2021-3907 gsd-2021-3907 2026-10-25T07:36:06.002726+00:00 gsd-2021-3907 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3907 UBUNTU-CVE-2021-3907 2026-10-25T07:36:06.002738+00:00

Affected: Ubuntu:Pro:20.04:LTS: fort-validator

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.