{"action":"Upgrade xrootd to 5.9.2 or later.","affected":[{"fixed":"5.9.2","introduced":"0"}],"component":"xrootd","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["5.9.2"],"ghsa_id":"GHSA-vj8v-p5vw-m6v5","id":"tcs_01M5KG09FYB9R5FDWHJW8MWSRH","modified_at":"2026-04-10T20:03:56.583796Z","published_at":"2026-04-10T19:50:39Z","references":["https://osv.dev/vulnerability/GHSA-vj8v-p5vw-m6v5","https://github.com/xrootd/xrootd/security/advisories/GHSA-vj8v-p5vw-m6v5","https://github.com/xrootd/xrootd/commit/45efac7267a115ca4f2102214498e8cb011eb69b","https://github.com/xrootd/xrootd","http://github.com/xrootd/xrootd/releases/tag/v5.9.2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-vj8v-p5vw-m6v5","url":"https://osv.dev/vulnerability/GHSA-vj8v-p5vw-m6v5"}],"summary":"xrootd has path traversal in directory listing that allows access to the parent directory via trailing \"..\" pattern"}