CVE-2021-3907: Cloudflare Octorpki

Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days.

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex. rsync://example.org/repo/../../etc/cron.daily/evil.roa), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on.

Affected products

• Cloudflare Octorpki: before 1.3.0 (fixed in 1.3.0)
• Debian Debian Linux: version 10.0 only; version 11.0 only

Published 2021-11-11. Last modified 2026-06-17.