Description

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T11:17:02.163Z",
  "pubdate": "2026-09-13T11:17:02.163Z",
  "executiveSummary": "A critical path traversal vulnerability exists in rustypaste versions prior to 0.18.1, stemming from improper validation of user-supplied custom filename headers.\nThe vulnerability allows remote, unauthenticated attackers to escape the restricted upload directory and write arbitrary files to the underlying filesystem.\nBy manipulating HTTP headers to include directory-traversal sequences, an attacker can influence the destination path of file write operations.\nThe risk implication is severe, as successful exploitation may lead to remote code execution (RCE), unauthorized modification of system configuration, or data destruction, depending on the file locations targeted by the attacker.\nThis flaw exists within the application's input handling logic, where the validation of the destination path occurs prior to the application of the custom filename, effectively rendering the initial security check obsolete.\nUsers are strongly advised to update to version 0.18.1 or later to remediate this flaw.",
  "technicalDetails": "The vulnerability originates from an incorrect sequencing of validation logic within the file upload processing pipeline of rustypaste.\nThe application performs a security check to validate the destination path of an uploaded file against the designated upload directory; however, this check is executed before the optional custom filename, provided via an HTTP header, is applied to the final file path.\nThis logic error facilitates a directory-traversal attack. An attacker can craft a malicious HTTP request containing a custom filename header that includes path traversal sequences, such as '../', which are processed after the initial validation step.\nWhen the application constructs the final write path, the path traversal sequences allow the filesystem API to resolve the file destination outside of the intended, isolated upload sandbox.\nThe attack flow proceeds as follows: 1) The attacker initiates an HTTP request to the upload endpoint. 2) The attacker specifies a custom filename header containing traversal sequences (e.g., '../../etc/cron.d/malicious_task'). 3) The application validates the base destination path, which passes the check. 4) The application subsequently applies the malicious custom filename, causing the filesystem write operation to target a directory outside the intended scope.\nBecause the validation check occurs prematurely, it fails to account for the modifications introduced by the user-supplied header, rendering the application susceptible to unauthorized file writes.\nThe vulnerability affects all versions of rustypaste prior to 0.18.1. Exploitation does not require prior authentication, as the upload functionality is often exposed to external network traffic.\nPost-exploitation, an attacker can overwrite critical system binaries, configuration files, or inject scheduled tasks to gain persistent access or elevate privileges on the hosting server."
}