CVE-2025-11233 Details
Description
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.
A path handling vulnerability has been identified in the Rust programming language, specifically in version 1.87.0 prior to 1.89.0, for the tier 3 Cygwin target (x86_64-pc-cygwin). The issue arises because the Cygwin target did not properly manage path separators, leading the standard library's Path API to overlook path components divided by backslashes. This flaw could cause programs compiled for Cygwin that perform path validation to malfunction, potentially enabling path traversal attacks or harmful operations on the filesystem. The vulnerability is not present in the tier 1 MinGW target (x86_64-pc-windows-gnu).
Users should upgrade to Rust version 1.89.0 or later. The Cygwin target can be manually compiled from source, as it is not available as a pre-built binary or through Rustup.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 1, 2025CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rust-lang/rust/pull/141864 | rust | ExploitIssue TrackingTechnical DescriptionVendor |
| https://groups.google.com/g/rustlang-security-announcements/c/oT9zCvLLYkw | rust | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | rust |
Affected Products
| Product | Versions |
|---|---|
| Rust | >= 1.87.0, < 1.89.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | rust |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | New CVE Received | rust |