CVE-2026-33242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33242", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T02:42:27.508Z", "datePublished": "2026-03-23T23:40:39.886Z", "dateUpdated": "2026-03-24T15:12:45.439Z"}, "containers": {"cna": {"title": "Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4"}, {"name": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20", "tags": ["x_refsource_MISC"], "url": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20"}, {"name": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3"}], "affected": [{"vendor": "salvo-rs", "product": "salvo", "versions": [{"version": ">= 0.39.0, < 0.89.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T23:40:39.886Z"}, "descriptions": [{"lang": "en", "value": "Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize \"../\" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the \".\" character. Version 0.89.3 contains a patch."}], "source": {"advisory": "GHSA-f842-phm9-p4v4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:13:09.802021Z", "id": "CVE-2026-33242", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:12:45.439Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33242", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:13:09.802021Z"}}}], "references": [{"url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:13:22.468Z"}}], "cna": {"title": "Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass", "source": {"advisory": "GHSA-f842-phm9-p4v4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "salvo-rs", "product": "salvo", "versions": [{"status": "affected", "version": ">= 0.39.0, < 0.89.3"}]}], "references": [{"url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "name": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20", "name": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3", "name": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize \"../\" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the \".\" character. Version 0.89.3 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T23:40:39.886Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33242", "state": "PUBLISHED", "dateUpdated": "2026-03-24T15:12:45.439Z", "dateReserved": "2026-03-18T02:42:27.508Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T23:40:39.886Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "salvo", "vendor": "salvo-rs", "versions": [{"status": "affected", "version": ">= 0.39.0, < 0.89.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:salvo:salvo:*:*:*:*:*:rust:*:*", "matchCriteriaId": "7449C04F-284B-49D5-97EC-527C92EDA4D9", "versionEndExcluding": "0.89.3", "versionStartIncluding": "0.39.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize \"../\" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the \".\" character. Version 0.89.3 contains a patch."}, {"lang": "es", "value": "Salvo es un framework web de Rust. Las versiones 0.39.0 a 0.89.2 tienen una vulnerabilidad de salto de ruta y omisi\u00f3n de control de acceso en el componente salvo-proxy. La vulnerabilidad permite a un atacante externo no autenticado omitir las restricciones de enrutamiento del proxy y acceder a rutas de backend no deseadas (p. ej., puntos finales protegidos o paneles administrativos). Este problema se origina en la funci\u00f3n encode_url_path, que no normaliza las secuencias '../' y las reenv\u00eda inadvertidamente tal cual al servidor ascendente al no volver a codificar el car\u00e1cter '.'. La versi\u00f3n 0.89.3 contiene un parche."}], "id": "CVE-2026-33242", "lastModified": "2026-06-17T10:37:10.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33242", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:13:09.802021Z", "version": "2.0.3"}}]}, "published": "2026-03-24T00:16:29.670", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.39.0,0.89.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "salvo", "source": "cna", "vendor": "salvo-rs"}, "product": "salvo", "vendor": "salvo-rs"}], "analysis": {"en": {"generated_at": "2026-03-24T20:32:09.613710+00:00", "value": {"mitigation_remediation": ["Upgrade Salvo to version 0.89.3 or later."], "summary": {"action": "Immediate Patch", "impact": "Directory Traversal / Access Control Bypass"}, "threat_synthesis": {"affected_systems": "The affected product is the Salvo Rust web framework provided by salvo-rs. Versions ranging from 0.39.0 up to and including 0.89.2 are impacted. Version 0.89.3 contains a fix for the issue.", "description_and_impact": "The flaw lies in the encode_url_path function of the salvo-proxy component, which fails to normalize \"../\" sequences and does not re\u2011encode the \".\" character, allowing crafted URLs to be forwarded unchanged to the upstream server. An unauthenticated external attacker can exploit this to bypass proxy routing constraints, reaching protected backend paths such as administrative dashboards or other sensitive endpoints. The vulnerability carries a CVSS score of 7.5, indicating a high degree of severity due to the potential for unauthorized access.", "risk_and_exploitability": "The EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting that large\u2011scale, pre\u2011employed attacks are not yet widespread. Nevertheless, the CVSS score and the nature of the flaw mean that an attacker who can send crafted requests to the proxy can gain unauthorized access to backend services. The exploit path does not require authentication or special permissions; it relies solely on manipulating the URL path passed to the proxy component."}}}}, "created": "2026-03-24T10:29:47.822215+00:00", "updated": "2026-03-25T20:35:54.688040+00:00", "vendors": ["salvo-rs", "salvo-rs$PRODUCT$salvo"]}