{"id":"CVE-2021-3907","aliases":["GHSA-8459-6rc9-8vf8","GHSA-cqh2-vc2f-q4fh","GO-2022-0248"],"url":"https://o3.security/vulnerability/CVE-2021-3907","summary":"Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki","details":"OctoRPKI does not escape a URI with a filename containing \"..\", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.","published":"2021-11-11T22:15:07.820Z","modified":"2026-07-08T06:00:41.237494390Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/cloudflare/cfrpki","fixedVersion":"1.4.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/cloudflare/cfrpki/security/advisories/GHSA-3jhm-87m6-x959"},{"type":"ADVISORY","url":"https://github.com/cloudflare/cfrpki/security/advisories/GHSA-cqh2-vc2f-q4fh"},{"type":"ADVISORY","url":"https://www.debian.org/security/2021/dsa-5033"},{"type":"ADVISORY","url":"https://www.debian.org/security/2022/dsa-5041"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:00:41.237494390Z"}}