A high-severity path traversal vulnerability in rustypaste allows unauthenticated attackers to write arbitrary files to the host filesystem, posing a critical risk of remote code execution.

The application fails to properly validate the destination path when an optional custom filename HTTP header is provided, allowing unauthenticated attackers to use directory traversal sequences (such as ../) to escape the intended upload directory.

Successful exploitation of this vulnerability permits an attacker to write files anywhere the rustypaste process has write permissions on the underlying server. This could lead to the overwriting of critical system configuration files, the placement of malicious scripts in startup directories, or the corruption of application data, resulting in full system compromise, unauthorized access, and significant operational downtime. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized filesystem manipulation.

Immediate Action: Upgrade to rustypaste version 0.18.1 or later immediately to incorporate the necessary path validation logic that prevents directory-escape attacks.

Proactive Monitoring: Review application access logs for HTTP requests containing unexpected directory traversal characters in the filename header, such as dot-dot-slash sequences.

Compensating Controls: If an immediate upgrade is not feasible, deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests that contain directory traversal patterns within the filename header.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk due to the potential for arbitrary file writes, which often serves as a precursor to more severe attacks like remote code execution. Administrators should prioritize patching to version 0.18.1 as the primary defense. Given the ease of triggering this flaw through simple HTTP requests, monitoring for suspicious traffic patterns is strongly recommended until the patch is deployed.