PT-2026-47302 · Unknown · Routinator

CVE-2026-49233 · Published 2026-06-08 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Routinator (affected versions not specified)

Description Routinator fails to properly validate the module component of rsync URIs used to generate file system paths for its cache. This lack of validation enables path traversal if a module name contains .. (dot-dot-slash), which could allow an attacker to gain access to the entire Routinator rsync cache.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-49233

GHSA-33MJ-99MG-8G73

Affected Products

Routinator

References · 9

• https://osv.dev/vulnerability/CVE-2026-49233 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49233 · Security Note
• https://osv.dev/vulnerability/GHSA-33mj-99mg-8g73 · Vendor Advisory
• https://nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt · Vendor Advisory
• https://github.com/NLnetLabs/routinator · Note
• https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2 · Note
• https://t.me/CVEtracker/56157 · Telegram Post
• https://t.me/cveNotify/167153 · Telegram Post
• https://t.me/cveNotify/166624 · Telegram Post