Path Traversal Vulnerability in Rustypaste Affected by Improper Filename Header Validation

CVE-2026-90774

What is CVE-2026-90774?

Rustypaste versions prior to 0.18.1 contain a security flaw in which the validation of destination paths is insufficient when using optional custom filename headers. This weakness allows attackers to craft malicious requests that include path traversal sequences in the filename header, enabling them to write files outside the designated upload directory. As a result, sensitive files could be overwritten or created in arbitrary locations on the server, potentially leading to further exploitation.

References