{"id":"CVE-2026-109118","title":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded trave…","summary":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded trave…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-22"],"vendor":"ikus-soft","product":"rdiffweb","affected":["rdiffweb < 7.1.1"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:04:29.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109118","references":[{"url":"https://gitlab.com/ikus-soft/rdiffweb","label":"cve@gitlab.com"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/commit/04b7096566811feb7d782e38560b44044fa91a29","label":"cve@gitlab.com"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/392","label":"cve@gitlab.com"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/393","label":"cve@gitlab.com"},{"url":"https://gitlab.com/ikus-soft/rdiffweb/-/work_items/394","label":"cve@gitlab.com"}],"tags":["nvd","cve.org"],"epss":0.00229,"epssPercentile":0.13662,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T14:11:18.524788Z"},"ingestedAt":"2026-10-16T11:04:58.139Z","slug":"CVE-2026-109118","body":"## Overview\n\nImproper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user already hold permissions on it; the issue can mislead a user into operating on, or deleting, data other than the repository displayed\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}