xrootd vulnerabilities

Products

• xrootd 2

Latest xrootd CVEs

Newest publication first

1. CVE-2026-125113 XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern

   Published 2026-11-09

   Medium·CVSS 5.3

   The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory co...

2. CVE-2017-1000215 ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

   Published 2017-11-17

   Critical·CVSS 9.8

   ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.