VULNERABILITY INTELLIGENCE

CVE-2021-3907

CVSS score7.4 HIGH
EPSS probability4.20%
CISA KEVNot currently listed
Published2021-11-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Description

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.

Weakness classification

  • cna@cloudflare.com: CWE-20
  • nvd@nist.gov: CWE-22

Primary references