Improper Path Containment in Ikus060 Rdiffweb by Ikus Soft

CVE-2026-109118

What is CVE-2026-109118?

An improper path containment check in Ikus060 Rdiffweb version 7.1.1 allows authenticated users to exploit a path traversal weakness. This flaw can enable a user to conduct actions such as browsing, restoring, viewing history, or deleting files that lie outside the intended repository. By using a percent-encoded traversal sequence (%2e%2e), users can manipulate the request path, which effectively misleads the system into permitting unauthorized access to sibling paths. The risk arises because the existing containment checks rely on string prefix comparison, failing to enforce proper filesystem boundaries. This vulnerability can potentially lead to unintentional data modifications or deletions, impacting data integrity and security for affected users.

References