Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-11233

Rust standard library didn't detect all path separators on Cygwin

Medium6.3EPSS 0.52%
Published
Updated
Reserved
Assigned by
rust

Description

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.

Scores

CVSS scores of CVE-2025-11233, by who scored it
Scored byCVSSScoreVector
rustCNA (assigner)4.0Medium6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/RE:L/U:Green
NVDNVD · Deferred4.0Medium6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:Green
EPSS (exploitation in 30 days)
0.52% · top 56% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

What to do

Solution: We recommend users of Cygwin targets to upgrade to 1.89.0 or a later version.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-11233 badge
[![CVE-2025-11233](https://trackcve.app/badge/CVE-2025-11233.svg)](https://trackcve.app/cve/CVE-2025-11233)

Record last updated .