What’s Vulnerable › Vulnerabilities
CVE-2026-49233: Routinator cache path traversal using rogue rsync URIs
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-08 · updated 2026-07-23
- Weakness: CWE-22
Description
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
Affected products
- NLnet Labs Routinator: before 0.15.2 — fixed in 0.15.2
How to fix
Upgrade to a fixed version: NLnet Labs Routinator 0.15.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-49233 or the next vulnerability affects your stack