CVE-2026-125113

Name of the Vulnerable Software and Affected Versions XRootD versions prior to 5.9.2

Description A path traversal issue exists where the rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc fails to reject a terminal two-dot component in a path. An unauthenticated attacker can append /.. to an exported path via xrdfs ls or an HTTP PROPFIND request to bypass the all.export directory scope. This allows the attacker to enumerate directories and filenames in the parent directory under oss.localroot. This specific vector does not allow for file downloads or the disclosure of file contents.

Recommendations Update to version 5.9.2. As a temporary workaround, restrict access to the rpCheck() function or the src/XrdXrootd/XrdXrootdXeq.cc module to minimize the risk of exploitation.