CVE-2026-49233
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.
Risk Assessment
The risk is unauthorized access to files in the Routinator cache, potentially leading to sensitive data disclosure or further attack escalation.
Recommendation
Update Routinator to a version that fixes rsync URI validation and restrict access to the cache.
Other vulnerabilities in Routinator
See all- CVE-2026-49235High
Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).
- CVE-2026-49234High
When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.
- CVE-2026-49232High
Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.
Original NVD description (English source)
Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.