CVE-2026-49233 — Routinator cache path traversal using rogue rsync URIs
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by…
Published: 2026-06-08 · CVSS: 8.3 · CVSS 4.0
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7