CVE-2026-57211: broadcom rabbitmq_server Absolute Path Traversal
Vulnerability summary
CVE-2026-57211 is a critical (CVSS 10.0) Absolute Path Traversal vulnerability in broadcom rabbitmq_server. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 13-07-2026Last modifiedVulnerability information updated.
Description
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated10.0CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRabbitmq Server
Maturity: poc
Weaknesses
CWE · root cause- CWE-36Absolute Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Broadcom1 product
- rabbitmq_server≥ 4.1.0, < 4.2.6
Rabbitmq1 product
- rabbitmq-server≥ 4.2.0, < 4.2.6 | ≥ 4.1.0, < 4.1.11
Ubuntu1 product
- rabbitmq-serverAll versions (No fix recorded)
3 vendors · 3 products
References
8 links- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6X Refsource CONFIRMREPORTExploitVendor Advisory
- github.com/rabbitmq/rabbitmq-server/commit/39c3a8e9c71da0403d8dfc13f700e60c936e3682X Refsource MISCREPORTPatch
- github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204X Refsource MISCREPORTPatch
