GHSA-f842-phm9-p4v4
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 19, 2026
CISA due date
—
The record
Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | salvo | 0.39.0 | 0.89.3 |
Related vulnerabilities
- CVE-2026-33242 Salvo is a Rust web framework. Same vulnerability
- CVE-2026-33241 Salvo is a Rust web framework. Also affects salvo
- GHSA-pp9r-xg4c-8j4x Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing Also affects salvo
- GHSA-rjf8-2wcw-f6mp Salvo is vulnerable to reflected XSS in the list_html function Also affects salvo
- GHSA-54m3-5fxr-2f3j Salvo is vulnerable to stored XSS in the list_html function by uploading files with… Also affects salvo
- CVE-2026-22256 Salvo is a Rust web backend framework. Also affects salvo
- CVE-2026-22257 Salvo is a Rust web backend framework. Also affects salvo
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22