RUSTSEC-2026-0276

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0276

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0276.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0276

Aliases

GHSA-72g6-wgrg-vhm7
RUSTSEC-2026-0277

Published

2026-08-26T12:00:00Z

Modified

2026-09-02T09:10:39.450016210Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Path traversal in apimock's file-serving fallback

Details

The file-serving fallback joined a request-derived path onto the configured response directory and checked only that the result existed, never that it stayed inside that directory. A request containing a raw .. segment could read any file readable by the process, returned with HTTP 200.

Read-only: no write, no code execution.

On the 4.x line apimock is a single crate containing the serving code. Fixed in 4.8.1 by canonicalising each resolved path and rejecting anything outside its base directory.

apimock 5.0.0 and later are not affected by this advisory. From 5.0.0 the serving code moved to the apimock-server crate, which apimock depends on; that crate carries its own advisory for the same issue, fixed in 5.19.1.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / apimock

Package

Name: apimock; View open source insights on deps.dev
Purl: pkg:cargo/apimock

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

4.8.1

Introduced

5.0.0

Fixed

5.0.0

Ecosystem specific

{
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    },
    "affected_functions": null
}

Database specific

cvss

"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"

source

"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0276.json"

informational

null