https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 21:19:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277174 EUVD-2026-277174 https://cve.radiocsirt.org/vuln/euvd-2026-277174 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33242 <p>Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize &#34;../&#34; sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the &#34;.&#34; character. Version 0.89.3 contains a patch.</p> <p>Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize &#34;../&#34; sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the &#34;.&#34; character. Version 0.89.3 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33242 https://cve.radiocsirt.org/vuln/ghsa-f842-phm9-p4v4 <p><strong>Affected:</strong> crates.io: salvo</p> <p>### Details</p> <p>A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework (v0.89.2). The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize &#34;../&#34; sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the &#34;.&#34; character.</p> <p>---</p> <p>### Technical Details</p> <p>If someone tries to attack by sending a special code like `%2e%2e`, Salvo changes it back to `../` when it first checks the path. The proxy then gets this plain `../` value. When making the new URL to send forward, the `encode_url_path` function tries to change the path again, but its normal settings do not include the `.` (dot) character. Because of this, the proxy puts `../` straight into the new URL and sends a request like `GET /api/../admin HTTP/1.1` to the backend server.</p> <p>```rust // crates/proxy/src/lib.rs (Lines 100-105)</p> <p>pub(crate) fn encode_url_path(path: &amp;str) -&gt; String { path.split(&#39;/&#39;) .map(|s| utf8_percent_encode(s, PATH_ENCODE_SET).to_string()) .collect::&lt;Vec&lt;_&gt;&gt;() .join(&#34;/&#34;) } ```</p> <p>---</p> <p>### PoC</p> <p>1 - Setup an Nginx Backend Server for example 2 - Start Salvo Proxy Gateway in other port routing to /api/ 3 - Run the curl to test the bypass:</p> <p>```bash curl -s http://127.0.0.1:808…</p> <p><strong>Affected:</strong> crates.io: salvo</p> <p>### Details</p> <p>A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework (v0.89.2). The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize &#34;../&#34; sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the &#34;.&#34; character.</p> <p>---</p> <p>### Technical Details</p> <p>If someone tries to attack by sending a special code like `%2e%2e`, Salvo changes it back to `../` when it first checks the path. The proxy then gets this plain `../` value. When making the new URL to send forward, the `encode_url_path` function tries to change the path again, but its normal settings do not include the `.` (dot) character. Because of this, the proxy puts `../` straight into the new URL and sends a request like `GET /api/../admin HTTP/1.1` to the backend server.</p> <p>```rust // crates/proxy/src/lib.rs (Lines 100-105)</p> <p>pub(crate) fn encode_url_path(path: &amp;str) -&gt; String { path.split(&#39;/&#39;) .map(|s| utf8_percent_encode(s, PATH_ENCODE_SET).to_string()) .collect::&lt;Vec&lt;_&gt;&gt;() .join(&#34;/&#34;) } ```</p> <p>---</p> <p>### PoC</p> <p>1 - Setup an Nginx Backend Server for example 2 - Start Salvo Proxy Gateway in other port routing to /api/ 3 - Run the curl to test the bypass:</p> <p>```bash curl -s http://127.0.0.1:808…</p> https://cve.radiocsirt.org/vuln/ghsa-f842-phm9-p4v4