CVE-2025-11233

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target. While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.

• CWE-22

• https://github.com/rust-lang/rust/pull/141864
• https://groups.google.com/g/rustlang-security-announcements/c/oT9zCvLLYkw

Published

Oct 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11226ACE vulnerability in conditional configuration file processi…7
• CVE-2025-11227The GiveWP – Donation Plugin and Fundraising Platform plugin…6.5
• CVE-2025-11228The GiveWP – Donation Plugin and Fundraising Platform plugin…5.3
• CVE-2025-1123The Solid Mail – SMTP email and logging made by SolidWP plug…7.2
• CVE-2025-11230Inefficient algorithm complexity in mjson in HAProxy allows …7.5
• CVE-2025-11232To trigger the issue, three configuration parameters must ha…7.5
• CVE-2025-11234A flaw was found in QEMU. If the QIOChannelWebsock object is…7.5
• CVE-2025-11235Unverified Password Change vulnerability in Progress MOVEit …7.5
• CVE-2025-11237The Make Email Customizer for WooCommerce WordPress plugin t…5.3
• CVE-2025-11238The Watu Quiz plugin for WordPress is vulnerable to Stored C…7.2
• CVE-2025-11239Potentially sensitive information in jobs on KNIME Business …4.3
• CVE-2025-11240An open redirect vulnerability existed in KNIME Business Hub…7.2