Path Handling Vulnerability in Cygwin Target of Rust
CVE-2025-11233

6.3MEDIUM

Key Information:

Vendor

Rust Project

Status
Std
Vendor
CVE Published:
1 October 2025

What is CVE-2025-11233?

The vulnerability in the Rust programming language affects the Cygwin target (x86_64-pc-cygwin) versions 1.87.0 to 1.88.0. This flaw results from improper handling of path separators within the standard library's Path API. As a consequence, programs that check or manipulate file paths may overlook certain path components represented by backslashes, potentially leading to unexpected behavior such as path traversal attacks or harmful filesystem operations. Rust 1.89.0 corrects this issue by ensuring both Win32 and Unix-style paths are properly processed. It's important to note that this vulnerability is relevant only for users who have compiled the specific Cygwin target from source, as no pre-built binaries are provided.

Affected Version(s)

std Windows 1.87.0 < 1.89.0

References

https://github.com/rust-lang/rust/pull/141864
patch
https://groups.google.com/g/rustlang-security-announcemen...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-11233 : Path Handling Vulnerability in Cygwin Target of Rust