PT-2025-40278 · Rust+1 · Rust+1

Ryotak · Published 2025-10-01 · Updated 2026-01-29 · CVE-2025-11233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rust versions 1.87.0 through 1.88.9

Description The standard library’s Path API did not correctly handle path separators on the tier 3 Cygwin target (x86 64-pc-cygwin) in versions prior to 1.89.0. This caused the API to ignore path components separated by backslashes. Programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. The issue was resolved in Rust 1.89.0 by correctly handling both Win32 and Unix style paths for the Cygwin target. The tier 3 Cygwin compilation target is only available when building from source and is not available through pre-built binaries or Rustup.

Recommendations Update to Rust version 1.89.0 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-02958

CVE-2025-11233

RHSA-2026:7288

Affected Products

Red Os

Rust

References · 15

• https://github.com/rust-lang/rust/pull/141864 · Patch
• https://cve.org/CVERecord?id=CVE-2025-11233 · Security Note
• https://groups.google.com/g/rustlang-security-announcements/c/oT9zCvLLYkw · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11233 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11233 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02958 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11233 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11233 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-11233 · Vendor Advisory
• https://twitter.com/CVEnew/status/1973431604530815009 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-rust-cve-2025-11233-7.3 · Note
• https://t.me/CVEtracker/33856 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-rust-cve-2025-11233-8.0 · Note