CVE-2026-109118

Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause browse, restore, history, and delete operations to resolve to a path outside the repository, via a percent-encoded traversal sequence (%2e%2e) in the request path. The issue arises because the containment check uses a string prefix comparison (startswith) instead of a filesystem path boundary check. The target must be a sibling path whose name begins with the repository path, and the user must already have permissions on it.

An authenticated user could accidentally or intentionally operate on data outside the displayed repository, including deleting it, potentially leading to data loss or modification. The risk applies to environments where multiple repositories share a common path prefix.

Update rdiffweb to a version that correctly checks filesystem path boundaries. Until then, consider restricting user permissions or isolating repositories.