CVE-2026-33242

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. Version 0.89.3 contains a patch.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20	Patch
https://github.com/salvo-rs/salvo/releases/tag/v0.89.3	Product Release Notes
https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4	Exploit Mitigation Vendor Advisory
https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:salvo:salvo:*:*:*:*:*:rust:*:*

History

No history.

Information

Published : 2026-03-24 00:16

Updated : 2026-03-24 19:37

NVD link : CVE-2026-33242

Mitre link : CVE-2026-33242

CVE.ORG link : CVE-2026-33242

JSON object : View

Products Affected

salvo

salvo

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-33242", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-24T00:16:29.670", "references": [{"url": "https://github.com/salvo-rs/salvo/commit/7bac30e6960355c58e358e402072d4a3e5c4e1bb#diff-e319bf7afcb577f7e9f4fb767005072f6335d23f306dd52e8c94f3d222610d02R20", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/salvo-rs/salvo/releases/tag/v0.89.3", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/salvo-rs/salvo/security/advisories/GHSA-f842-phm9-p4v4", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize \"../\" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the \".\" character. Version 0.89.3 contains a patch."}, {"lang": "es", "value": "Salvo es un framework web de Rust. Las versiones 0.39.0 a 0.89.2 tienen una vulnerabilidad de salto de ruta y omisi\u00f3n de control de acceso en el componente salvo-proxy. La vulnerabilidad permite a un atacante externo no autenticado omitir las restricciones de enrutamiento del proxy y acceder a rutas de backend no deseadas (p. ej., puntos finales protegidos o paneles administrativos). Este problema se origina en la funci\u00f3n encode_url_path, que no normaliza las secuencias '../' y las reenv\u00eda inadvertidamente tal cual al servidor ascendente al no volver a codificar el car\u00e1cter '.'. La versi\u00f3n 0.89.3 contiene un parche."}], "lastModified": "2026-03-24T19:37:42.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:salvo:salvo:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "7449C04F-284B-49D5-97EC-527C92EDA4D9", "versionEndExcluding": "0.89.3", "versionStartIncluding": "0.39.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}