Verification of the upstream fix commit for CVE-2026-90774 identified an incomplete path sanitization check and a sibling handler path that joins user-influenced path segments onto the server upload directory without canonical path containment.
When a security patch sanitizes a single entry point by stripping or rejecting literal parent-directory tokens before joining a path onto a storage root, sibling handlers in the same module that construct file paths from request metadata or remote URLs must enforce the same containment boundary.
Detailed handler and path construction notes have been filed privately with the upstream maintainer under GHSA-f3p7-gghf-cqc5 via GitHub Private Vulnerability Reporting. Full technical specifics and the remediation diff will be published on this page once an upstream release is available.
Upgrade to the patched rustypaste release once published under GHSA-f3p7-gghf-cqc5. Until a patched version is deployed, restrict untrusted upload access at the reverse proxy.