CVE-2026-109118 Details
Description
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed
A path traversal vulnerability has been identified in Ikus060 Rdiffweb version 7.1.1. This issue allows authenticated users to manipulate browse, restore, history, and delete operations to target paths outside the intended repository. The vulnerability arises from an improper path containment check, which relies on string prefix comparisons instead of proper filesystem path boundary validations. Exploitation involves using a percent-encoded traversal sequence to access sibling paths, potentially leading to unintended data manipulation or deletion.
Users are advised to update to Rdiffweb version 7.2.0, which addresses this vulnerability by implementing proper path containment checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/ikus-soft/rdiffweb | [email protected] | Vendor |
| https://gitlab.com/ikus-soft/rdiffweb/-/commit/04b7096566811feb7d782e38560b44044fa91a29 | [email protected] | Source CodeVendor |
| https://gitlab.com/ikus-soft/rdiffweb/-/work_items/392 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.com/ikus-soft/rdiffweb/-/work_items/393 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.com/ikus-soft/rdiffweb/-/work_items/394 | [email protected] | Issue TrackingPermission RequiredVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ikus060 rdiffweb | 7.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |