7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33242

CVE-2026-33242: Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths (e.g., protected endpoints or administrative dashboards). This issue stems from the encode_url_path function, which fails to normalize "../" sequences and inadvertently forwards them verbatim to the upstream server by not re-encoding the "." character. Version 0.89.3 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33242

CVE-2026-33242:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salvo	rust	>= 0.39.0, <= 0.89.2	0.89.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis is based on the provided commit 7bac30e6960355c58e358e402072d4a3e5c4e1bb, which, while intending to fix a separate issue, introduced a path traversal vulnerability. The core of the vulnerability lies in the newly added salvo_proxy::encode_url_path function. This function is responsible for encoding the path portion of a URL before forwarding a request to an upstream server. However, the implementation fails to normalize the path and does not properly handle path traversal sequences like '..'.

The salvo_proxy::Proxy::handle function was modified in the same commit to use this new, vulnerable function. It extracts a wildcard path parameter from the request and passes it directly to encode_url_path. When an attacker sends a request with a URL-encoded path traversal sequence (e.g., /api/%2e%2e/admin), the Salvo framework decodes it to /api/../admin. This string is then passed to encode_url_path, which does not sanitize the '..' segment, forwarding it to the backend. This allows the attacker to bypass API gateway routing restrictions and access unintended backend paths. Both Proxy::handle (as the entry point for tainted input) and encode_url_path (as the flawed processing function) would appear in a runtime profile during exploitation.

Vulnerable functions

salvo_proxy::encode_url_path

crates/proxy/src/lib.rs

This function is vulnerable to path traversal because it encodes path segments without normalizing them. It does not handle '..' sequences, allowing them to be passed through to the upstream server. An attacker can use URL-encoded '..' sequences (e.g., '%2e%2e') to bypass the proxy's routing rules and access unauthorized endpoints on the backend server.

salvo_proxy::Proxy::handle

crates/proxy/src/lib.rs

This handler function takes a path parameter from the incoming request and passes it to the vulnerable `encode_url_path` function. It serves as the entry point for the malicious input, which is then processed improperly, leading to the path traversal vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.