Skip to content
Fencer Vulns
medium 6.3

CVE-2025-11233 json

Rust standard library didn't detect all path separators on Cygwin

published 2025-10-01 13 mo ago modified 2026-10-09 31 d ago also EUVD-2025-33229

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations.

Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target.

While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.

Patch / fix

  • Rust Project std 1.89.0
  • rustc Debian 14 1.89.0+dfsg1-1

debian advisories DEBIAN-CVE-2025-11233

  • rust hummingbird 1 1.97.1-2.hum1
  • cargo hummingbird 1 1.97.1-2.hum1
  • clippy hummingbird 1 1.97.1-2.hum1
  • rustfmt hummingbird 1 1.97.1-2.hum1
  • rust-gdb hummingbird 1 1.97.1-2.hum1
  • rust-src hummingbird 1 1.97.1-2.hum1
  • rust-lldb hummingbird 1 1.97.1-2.hum1
  • rust-analyzer hummingbird 1 1.97.1-2.hum1

red hat advisories RHSA-2026:45341

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-11233 updated cvss 6.5

rust: Rust standard library didn't detect all path separators on Cygwin

  • Red Hat Hardened Images rust 1.97.1-2.hum1, cargo 1.97.1-2.hum1, clippy 1.97.1-2.hum1, rustfmt 1.97.1-2.hum1, rust-gdb 1.97.1-2.hum1, rust-src 1.97.1-2.hum1, +11 more
    fixed: vendor fix RHSA-2026:45341
  • Red Hat Enterprise Linux 8 rls, rust, cargo, clippy, rustfmt, rust-gdb, +8 more Red Hat Enterprise Linux 9 rust, cargo, clippy, rustfmt, rust-gdb, rust-src, +8 more Red Hat Enterprise Linux 10 rust
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
13 mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/RE:L/U:Green
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:Green

Affected products

  • Rust Project std

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.