Salvo-rs vulnerabilities
We track 4 vulnerabilities in Salvo-rs products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on March 24, 2026.
Latest Salvo-rs vulnerabilities
- 7.5 High severity
salvo: Improper Limitation of a Pathname to a Restricted Directory
Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and acce
- 7.5 High severity
salvo: Allocation of Resources Without Limits or Throttling
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-of
- 8.8 High severity
salvo: Improper Neutralization of Input During Web Page Generation
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files u
- 8.8 High severity
salvo: Improper Neutralization of Input During Web Page Generation
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current path, in which its inserted in the HTML without proper sanitation, this leads to reflected XSS using