CVE-2026-90774

EUVD-2026-76995
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/orhun/rustypaste
https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs
https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8
https://github.com/orhun/rustypaste/issues/622
https://www.vulncheck.com/advisories/rustypaste-before-0.18.1-path-traversal-via-filename-header