The vulnerability occurs in the rpCheck() function of XRootD, where a terminal two‑dot component is not properly rejected. An attacker can append "/.." to an exported path in an XRDFS ls or HTTP PROPFIND request, bypassing the all.export directory scope. This allows enumeration of files and directories in the parent directory under oss.localroot. While the flaw does not permit file download or disclosure of file contents, the ability to list parent directory entries can aid in reconnaissance and further attacks. The weakness is described by CWE-20 and CWE-22.

Vendor XRootD, product XRootD. Versions before 5.9.2 are affected; the issue is fixed in version 5.9.2 and later.

The CVSS score of 5.3 classifies this as a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV, indicating a lower likelihood of widespread exploitation. The attack can be performed unauthenticated over the network using XRDFS ls or HTTP PROPFIND, so remote attackers can enumerate directory contents of the parent directory without authentication.