Directory Enumeration Vulnerability in XRootD by XRootD Project

CVE-2026-125113

What is CVE-2026-125113?

The XRootD project has identified a vulnerability within its rpCheck() function, which fails to adequately handle certain directory-path components. Specifically, prior to version 5.9.2, the function allows unauthenticated attackers to append /.. in exported paths during xrdfs ls or HTTP PROPFIND requests. This behavior compromises directory scope limitations, enabling enumeration of directories and filenames in the parent directory under oss.localroot. It is important to note that while this vulnerability does not facilitate file downloads or content exposure, it can be exploited to gather sensitive directory information. The issue has been resolved in version 5.9.2, and users of affected versions are urged to upgrade.

References