CVE-2026-97365

chonkie-inc littrs lib.rs mount path traversal

View on CVE.org
Published Sep 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A path traversal flaw exists in the Sandbox::mount function of the littrs library version 0.6.1 and 0.6.2. By providing a specially crafted relative argument, an attacker can cause the program to mount or access directories outside the intended sandbox, potentially exposing confidential files or sensitive configuration data. The vulnerability is a classic present‑in‑path traversal (CWE-22) and could allow an adversary to read or manipulate files the application is not meant to access.

Affected Systems

The affected product is chonkie-inc:littrs, currently at versions 0.6.1 and 0.6.2. No other versions or vendors are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and no EPSS data is currently available. The vulnerability is not listed in CISA’s KEV catalog, but it is publicly disclosed and can be triggered remotely, which means an attacker with network access to the instance can exploit the flaw. Attackers would simply supply a malicious relative path to the mount endpoint to traverse directories, suggesting a low barrier to exploitation given a reachable interface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Limit network access to the littrs service, ensuring only trusted hosts or IP ranges can reach it.
  • Implement input validation on the mount endpoint to reject any relative paths containing '..' or that resolve outside the intended base directory, preferably by canonicalizing inputs before processing.
  • Monitor service logs for anomalous mount requests or repeated directory traversal attempts and respond accordingly.

Generated by OpenCVE AI on September 25, 2026 at 04:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title chonkie-inc littrs lib.rs mount path traversal
First Time appeared Chonkie-inc
Chonkie-inc littrs
Weaknesses CWE-22
CPEs cpe:2.3:a:chonkie-inc:littrs:*:*:*:*:*:*:*:*
Vendors & Products Chonkie-inc
Chonkie-inc littrs
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 3:11 AM
Reserved
Sep 24, 2026, 1:45 PM

View source JSON

Updated
Sep 29, 2026, 3:11 AM

JSON

Status
Deferred
Published
Sep 24, 2026, 8:17 PM
Modified
Sep 29, 2026, 4:18 AM

View source JSON

No data.

Updated
Sep 25, 2026, 2:15 PM

JSON