An unauthenticated path traversal vulnerability in the Salvo Rust framework allows remote attackers to bypass proxy routing constraints and access sensitive internal endpoints.

The flaw is a path traversal vulnerability (CWE-22) located in the encode_url_path function. It allows an unauthenticated attacker to inject directory traversal sequences that are improperly normalized, leading to the unauthorized exposure of protected backend resources.

The vulnerability carries a CVSS score of 7.5, reflecting a High severity impact. By bypassing proxy routing, an attacker can gain unauthorized access to protected administrative dashboards or sensitive backend data. This exposure poses a significant risk of data exfiltration and potential compromise of internal systems, which could lead to severe reputational damage and operational disruption.

Immediate Action: Update the Salvo framework to version 0.89.3 or later immediately to incorporate the necessary fix in the encode_url_path function.

Proactive Monitoring: Review web server and application proxy logs for suspicious URL patterns containing directory traversal sequences, such as multiple dot-slash combinations.

Compensating Controls: Implement strict URL filtering and path validation at the edge or WAF level to block requests containing unauthorized traversal characters before they reach the Salvo proxy component.

Public Exploit Available: No

Given the High severity of this access control bypass and the existence of a proof-of-concept, organizations using the Salvo framework must prioritize the update to version 0.89.3. Immediate patching is the only definitive way to close the path traversal vector and secure protected backend endpoints from unauthorized access.