AIKIDO-2026-508093
cap-primitives is vulnerable to Path Traversal
90
Critical Risk
This Affects:
cap-primitivesTL;DR
The manually::open path resolver in cap-primitives re-appends a trailing slash to the final path component before opening it with symlink following disabled. Because a trailing slash makes the operating system treat the final component as non-final, the kernel follows a symlink there and the intended O_NOFOLLOW protection is defeated. A path ending in /, or a symlink whose target ends in /, lets filesystem operations resolve outside the capability sandbox and read or write files in the wider filesystem from safe Rust code. The fix stops re-appending trailing slashes before opening paths with symlink following disabled.
Who does this affect?
You are affected if your application resolves untrusted or externally influenced filesystem paths (or paths whose components come from symlink targets) through cap-primitives/cap-std with symlink following disabled, and any such path can end in a trailing slash. The trailing-slash re-append defeats the O_NOFOLLOW-style confinement on Windows, on FreeBSD without O_RESOLVE_BENEATH, on macOS and other Unix without openat2, and on Linux 5.6 or when openat2 returns an error, allowing resolution outside the capability sandbox.
Background info
cap-primitives is vulnerable to Path Traversal in versions 0.9.0 - 3.4.5 and 4.0.0 - 4.0.2.
How to fix this
Upgrade the cap-primitives and/or the cap-std library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant