XRootD path traversal in directory listing

Executive brief

XRootD is a high-performance data access framework used primarily in large-scale scientific computing. A security flaw allows unauthorized users to view the names of files and folders outside of the areas they are permitted to access. While attackers cannot download the actual files, this exposure of directory structures can reveal sensitive information about the server's organization and data holdings.

Technical details

A path traversal vulnerability exists in XRootD's directory listing implementation within `src/XrdXrootd/XrdXrootdXeq.cc`. The functions `rpCheck()` and `Squash()` fail to properly validate paths ending in a trailing '..' without a following slash. By appending '/..' to an authorized export path in `xrdfs ls` or `HTTP PROPFIND` requests, an attacker can bypass `all.export` restrictions to list the contents of the parent directory. While the vulnerability allows for information disclosure via directory enumeration, file retrieval (downloading) is prevented by separate checks in the filesystem layer. The issue is fixed in version 5.9.2.

Affected products

• xrootd xrootd < 5.9.2

Timeline

• 2026-04-09: disclosed
• 2026-04-09: patched: Fixed in version 5.9.2
• 2026-04-10: advisory

References

• https://api.github.com/users/Rydzz7
• https://github.com/Rydzz7
• https://api.github.com/users/Rydzz7/gists%7B/gist_id%7D
• https://api.github.com/users/Rydzz7/repos
• https://avatars.githubusercontent.com/u/187525273?v=4
• https://api.github.com/users/Rydzz7/events%7B/privacy%7D