CVE-2026-90774

rustypaste, a self-hosted file upload and pastebin server written in Rust, contains a path traversal vulnerability in versions before 0.18.1. The application validates the destination upload path before applying the optional custom filename HTTP header, so an attacker who can reach the upload endpoint can supply path traversal sequences (e.g., '../') in that header to bypass directory-escape checks. This allows writing files outside the configured upload directory to arbitrary locations on the server, which can be leveraged to overwrite configuration files, drop files into web roots or other sensitive paths, and ultimately compromise the host. Any deployment running a version before 0.18.1 is affected, and the CVSS 4.0 score of 8.7 (network, no privileges, no user interaction, high integrity impact) reflects that the upload endpoint is assumed to be reachable without authentication. The flaw is fixed in 0.18.1; no public proof of concept or exploitation in the wild is currently known.

What to do: Upgrade to rustypaste 0.18.1 or later immediately. As an interim mitigation, strip or reject the custom filename HTTP header at the reverse proxy, and run rustypaste under a least-privilege user or container so writes outside the upload directory fail. Audit the host for unexpected files created outside the configured upload directory, including web roots, home directories, and service configuration paths, since successful exploitation leaves file-write artifacts.