CVE-2026-49233High▾ TwilightRoutinator has cache path traversal when processing the module component of rsync URIs
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.4%
0.4% → 0.5%
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
routinator <= 0.15.1Upgrade to a patched release:
routinator 0.15.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49235HighRoutinator crashes when encountering maliciously crafted RRDP XML files
CVE-2026-49234High· 7.5Routinator crashes when sending a maliciously crafted select-asn query parameter
CVE-2026-72753High· 8.2Routinator incorrectly handles delta updates
CVE-2026-72755Low· 3.8Routinator stores TA certificate in cache without validation
CVE-2026-72752Medium· 6.5Routinator exits when requesting the output repeatedly
CVE-2026-72754High· 7.5Routinator exits when parsing an incorrect or very large CRL file