CVE-2025-11233
BaseFortify
Publication date: 2025-10-01
Last updated on: 2025-10-02
Assigner: rust
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rust | rust | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Rust versions from 1.87.0 up to but not including 1.89.0 when targeting the tier 3 Cygwin platform (x86_64-pc-cygwin). The issue is that the Rust standard library's Path API did not correctly handle path separators, causing it to ignore path components separated by backslashes. This flaw can cause programs compiled for Cygwin that validate paths to misbehave, potentially allowing path traversal attacks or malicious filesystem operations. The problem is fixed in Rust 1.89.0 by properly handling both Windows and Unix style paths for the Cygwin target.
How can this vulnerability impact me? :
If you manually compiled Rust for the tier 3 Cygwin target (x86_64-pc-cygwin) between versions 1.87.0 and before 1.89.0, this vulnerability could allow attackers to exploit path validation flaws in your programs. This could lead to path traversal attacks or unauthorized malicious filesystem operations. However, if you use pre-built Rust binaries or other targets like the tier 1 MinGW target, you are not affected.
What immediate steps should I take to mitigate this vulnerability?
If you have manually compiled the Rust tier 3 Cygwin target (x86_64-pc-cygwin) between versions 1.87.0 and before 1.89.0, update to Rust 1.89.0 or later to fix the path separator handling issue. If you have not manually compiled this target, you are not affected. Avoid using the vulnerable Rust versions for the Cygwin target and verify your builds to ensure they do not use the affected Rust versions.