CVE-2026-125113 XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125113?
CVE-2026-125113 is a medium-severity vulnerability in xrootd, published on 9 Nov 2026.
Official description
The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when two dots are followed by a slash and does not reject a terminal two-dot component. An unauthenticated attacker can append /.. to an exported path in xrdfs ls or an HTTP PROPFIND request, bypass the all.export directory scope, and cause directory and filename enumeration in the parent directory under oss.localroot. The demonstrated vector does not permit file download or disclose file contents. This issue is fixed in version 5.9.2.
Which versions are affected by CVE-2026-125113?
1 open source package ship an affected version, including xrootd.
| Package | Affected | Fixed in |
|---|---|---|
xrootd PyPI | All versions | 5.9.2 |
How do I fix CVE-2026-125113?
Upgrade xrootd to 5.9.2 or later.
Is CVE-2026-125113 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-125113 exists.
Sources
Also known as GHSA-vj8v-p5vw-m6v5, UBUNTU-CVE-2026-125113.