The flaw is an improper pathname containment check in rdiffweb 7.1.1 that allows an authenticated user to cause browse, restore, history, and delete operations to resolve to a path outside the intended repository by using a percent‑encoded traversal sequence (%2e%2e) in the request path. The containment logic relies on a simple string prefix comparison rather than a filesystem boundary check, which can read, modify, or delete files in a sibling directory that shares a common prefix with the repository name if the user already has permissions on that directory.

The vulnerability affects the rdiffweb application from ikus-soft, specifically version 7.1.1; the vendor recommends upgrading to 7.2.0 or later.

The CVSS score of 4.6 indicates moderate risk, and EPSS is not available; the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user with sufficient permissions on a sibling directory whose name begins with the repository path; the attacker could read or delete files outside the visible repository, potentially exposing or corrupting unrelated data.