PT-2026-47302 · Nlnet · Routinator

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-49233

NVD

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-49233

Affected Products

Routinator

References · 2

• https://nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49233 · Security Note