CVE-2026-57211

Katalog CVE

CVSS 10.0 · Critical EPSS 0,63%

Kerentanan Absolute Path Traversal pada broadcom rabbitmq server. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-36: Absolute Path Traversal
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6 exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/39c3a8e9c71da0403d8dfc13f700e60c936e3682 patch
• https://github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204 patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15803 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 release notes