CyberRota Analysis
AI-GeneratedRustypaste versions prior to 0.18.1 are vulnerable due to inadequate validation of the destination path when handling the optional custom filename HTTP header, enabling attackers to exploit directory traversal vulnerabilities. This flaw allows unauthorized file writes to arbitrary locations outside the designated upload directory, posing a significant risk of data compromise. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.