https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T21:19:43.467911+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-277174 EUVD-2026-277174 2026-10-14T21:19:43.470199+00:00 EUVD-2026-277174 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33242 fkie_cve-2026-33242 2026-10-14T21:19:43.470229+00:00

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. Version 0.89.3 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-f842-phm9-p4v4 GHSA-f842-phm9-p4v4 — Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass 2026-10-14T21:19:43.470263+00:00

Affected: crates.io: salvo

### Details

A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework (v0.89.2). The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character.

---

### Technical Details

If someone tries to attack by sending a special code like `%2e%2e`, Salvo changes it back to `../` when it first checks the path. The proxy then gets this plain `../` value. When making the new URL to send forward, the `encode_url_path` function tries to change the path again, but its normal settings do not include the `.` (dot) character. Because of this, the proxy puts `../` straight into the new URL and sends a request like `GET /api/../admin HTTP/1.1` to the backend server.

```rust // crates/proxy/src/lib.rs (Lines 100-105)

pub(crate) fn encode_url_path(path: &str) -> String { path.split('/') .map(|s| utf8_percent_encode(s, PATH_ENCODE_SET).to_string()) .collect::<Vec<_>>() .join("/") } ```

---

### PoC

1 - Setup an Nginx Backend Server for example 2 - Start Salvo Proxy Gateway in other port routing to /api/ 3 - Run the curl to test the bypass:

```bash curl -s http://127.0.0.1:808…