CVE-2026-49233

7.5 HIGH

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator ...

Published: 2026-06-08 · Last updated: 2026-06-12

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-22

Affected products

Vendor	Product
nlnetlabs	routinator

Description

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-49233
[Vendor advisory]https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49233.txt

Related CVEs

Same vendor

CVE-2026-49235 — When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes (7.5 HIGH)
CVE-2026-49234 — When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes (7.5 HIGH)
CVE-2026-44608 — NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are m... (5.9 MEDIUM)
CVE-2026-44390 — NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs... (5.3 MEDIUM)
CVE-2026-42960 — NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section (10.0 CRITICAL)

Same CWE

CVE-2026-47368 — A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to ob... (8.6 HIGH)
CVE-2026-45171 — Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to ...
CVE-2025-24268 — A parsing issue in the handling of directory paths was addressed with improved path validation (5.5 MEDIUM)
CVE-2026-49982 — tmp is a temporary file and directory creator for node.js (8.2 HIGH)
CVE-2026-44705 — tmp is a temporary file and directory creator for node.js