Junglewise Threat Intelligence

CVE-2026-33242: Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

CVE-2026-33242 · Severity: low · CVSS 3.1 · Published 2026-03-19

Technologies: salvo (crates.io). Vendors: crates.io.

Executive brief

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Affected products

crates.io salvo

Related threats

Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
Salvo is vulnerable to reflected XSS in the list_html function
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names