← Database

CVE-2026-44373

MEDIUM CVSS: 5.3 Published: 2026-05-13 Modified: 2026-06-17

Description

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

Affected Platforms

Nitro Nitro

Weakness Type

CWE-22

References