Path Traversal in File Upload Validation Logic

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90774 affects rustypaste versions before 0.18.1, a file-sharing utility that processes HTTP uploads. The vulnerability stems from a validation order flaw: the application checks the destination path for traversal sequences, but performs this validation *before* applying custom filename headers supplied by attackers. This allows an attacker to bypass directory-escape protections by encoding path traversal payloads (e.g., `../../../etc/passwd`) in the filename parameter, enabling arbitrary file writes outside the intended upload directory. Organizations using rustypaste for internal file sharing, collaborative workflows, or public paste services face data corruption, system compromise, and potential lateral movement if writable system directories are targeted.

Casky's 351 mapped skills detect the attack patterns underlying this CVE by analyzing Initial Access (TA0001) and Discovery (TA0007) behaviors. Claude's extended reasoning identifies the validation bypass through: (1) HTTP header manipulation patterns that precede successful file writes to unexpected locations, (2) filename parameters containing path traversal sequences like `../` or URL-encoded variants, and (3) POST requests to upload endpoints with destination paths that diverge from configured directories. Practitioners reviewing Casky findings would see flagged HTTP requests with suspicious filename headers, timeline correlations showing validation checks occurring before header processing, and file system events writing to out-of-bounds locations—clear indicators of this specific class of path traversal exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90774.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-90774

Casky has 351 skills that investigate the attack patterns behind CVE-2026-90774. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn