Routinator does not properly validate the module component of rsync URIs, allowing a knowledgeable attacker to include the substring '..' and traverse outside of the intended cache directory. This flaw (CWE‑22) can expose the entire Routinator rsync cache to read access.

All NLnet Labs Routinator releases prior to version 0.15.2 are affected. The fix is present in version 0.15.2 and all subsequent releases.

The CVSS score of 8.3 denotes a high severity, indicating a significant potential for confidentiality loss if the cache is accessed. The vulnerability requires that an attacker be able to influence the module component of rsync URIs that the Routinator instance accepts. No public exploit or KEV listing is available, and EPSS information is not provided, so the likelihood of exploitation remains uncertain. Resolving the issue by updating to 0.15.2 removes the flaw, but until then, crafted rsync URLs containing '..' in the module name can be used to read arbitrary files within the cache directory.