ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-125113

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

Published Apr 10, 2026 · catalog updated Nov 9, 2026 · xrootd has path traversal

Last checked Nov 10, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-125113. EPSS is 0.34%. Act only if a listed version of xrootd has path traversal is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (xrootd has path traversal).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Advisory link
Affected products
PyPI xrootd

## Summary A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending (specifically without trailing slash) to an exported path in or requests. This bypass ignores the restriction. ## Affected component , and more precisely the functions and used in ([link](https://github.com/xrootd/xrootd/blob/19aa6dee76906fb4d56ded55e49bbe4171ade915/src/XrdXrootd/XrdXrootdXeq.cc#L696)), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer. ## PoC ### Configuration - **Configuration file:** - **Filesystem layout on the server:** - **Starting the server:** ### Steps to reproduce **Normal behavior (access outside export is denied):** **Bypass via trailing :** **Also exploitable via HTTP PROPFIND:** Returns HTTP 200 with full listing of the parent directory, including unexported entries ( , ). **However, file download via this path traversal is blocked:** ## Impact An attacker can enumerate directories and filenames outside the authorized export scope defined by . In the example above, a server exporting only leaks the existence of and located in the parent directory ( ). File download is not possible through this vector, as correctly rejects the path with error 3010. The impact seems therefore limited to **information disclosure** (directory and filename enumeration). This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself. ## Suggested fix In ( ), change:

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI xrootd0 → 5.9.2

How to fix CVE-2026-125113

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-125113. EPSS is 0.34%. Act only if a listed version of xrootd has path traversal is installed.

Which versions are affected?

Compare what you have installed with 0 → 5.9.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-20: Improper Input Validation; CWE-22: Path Traversal. EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2026 · PyPA Advisory Database

    Detected

    ## Summary A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending (specifically without trailing slash) to an exported path in or requests. This bypass ignores the restriction. ## Affected component , and more precisely the functions and used in ([link](https://github.com/xrootd/xrootd/blob/19aa6d

  2. Nov 9, 2026 · PyPA Advisory Database

    Fix available

    xrootd fixed in 5.9.2

  3. Nov 9, 2026 · PyPA Advisory Database

    Fix available

    xrootd fixed in 5.9.2

  4. Nov 9, 2026 · PyPA Advisory Database

    Updated

    ## Summary A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending (specifically without trailing slash) to an exported path in or requests. This bypass ignores the restriction. ## Affected component , and more precisely the functions and used in ([link](https://github.com/xrootd/xrootd/blob/19aa6d

Sources

  • CVE.orgVulnerability recordCVE-2026-125113

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-125113

    30-day exploitation probability 0.34%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-vj8v-p5vw-m6v5

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-vj8v-p5vw-m6v5

    xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-vj8v-p5vw-m6v5

    xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

    osv.dev

References

Freshness

Last verified in this catalog Nov 10, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • PyPA Advisory DatabaseNov 10, 2026
  • FIRST EPSSNov 10, 2026
  • GitHub Advisory DatabaseNov 10, 2026
  • OpenSSF OSV / OSV ScannerNov 10, 2026
  • CVE.orgNov 10, 2026