GHSA-8hcm-m7r7-frwcRUSTSEC-2026-0443
On Windows volumes with 8.3 short names, actix_files::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.
A remote client can read files such as .env or .git/config in the served directory even when use_hidden_files() is not enabled. This can expose secrets or source code.
Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.
AI analysis
Not analysed yet.
Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.
| Product | Affected versions | Fixed in | Source |
|---|---|---|---|
| actix-filescrates.io | >= 0.0.0-0, < 0.7.4 | 0.7.4 | OSV |
No weakness classification (CWE) has been assigned yet.
Published
First publication at the source
Last modified
Latest change at the source
Collected
First seen by Baba Yaga Security