CVE-2025-11233 Rust standard library didn't detect all path separators on Cygwin
Rust standard library on Cygwin ignored backslashes, enabling path traversal in applications compiled for this specific target.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11233?
CVE-2025-11233 is a medium-severity path traversal vulnerability in Rust Project std, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations.
Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target.
While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.
Weakness: CWE-22
Which versions are affected by CVE-2025-11233?
How do I fix CVE-2025-11233?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-11233 being exploited?
There is no known exploitation of CVE-2025-11233 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-11233, UBUNTU-CVE-2025-11233.