CVE-2026-49233

The record

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Affected packages

Related vulnerabilities

• GHSA-33mj-99mg-8g73 Routinator has cache path traversal when processing the module component of rsync URIs Same vulnerability
• GHSA-5qf9-cf9c-hjc6 Routinator crashes when encountering maliciously crafted RRDP XML files Also affects routinator
• GHSA-gc6q-cwcj-3vh9 Routinator crashes when sending a maliciously crafted select-asn query parameter Also affects routinator
• CVE-2026-49235 When Routinator encounters a file via RRDP using a specifically crafted Document Type… Also affects routinator
• CVE-2026-49234 When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the… Also affects routinator
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
• CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
• CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22