RUSTSEC-2026-0277

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2026-0277
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0277.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2026-0277
Aliases
Published
2026-08-26T12:00:00Z
Modified
2026-09-02T09:10:39.450016210Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Path traversal in apimock-server's file-serving fallback
Details

The file-serving fallback joined a request-derived path onto the configured response directory and checked only that the result existed, never that it stayed inside that directory. A request containing a raw .. segment could read any file readable by the process, returned with HTTP 200.

Read-only: no write, no code execution.

Exposure depends on the bind address. The default is 127.0.0.1; deployments binding 0.0.0.0 or a LAN address are reachable from the network. Most HTTP clients normalise .. away before sending, so reaching it requires a client that does not.

All published versions before 5.19.1 are affected. Fixed in 5.19.1 by canonicalising each resolved path and rejecting anything outside its base directory.

This advisory also covers apimock 5.x, which depends on apimock-server. apimock 4.x predates the crate split and carries its own advisory for the same issue, fixed in 4.8.1.

Database specific 
{
    "license": "CC0-1.0"
}
References

Affected packages

crates.io / apimock-server

Package

Name
apimock-server
View open source insights on deps.dev
Purl
pkg:cargo/apimock-server

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0
Fixed
5.19.1

Ecosystem specific 

{
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    },
    "affected_functions": null
}

Database specific

cvss 
"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
source 
"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0277.json"
informational 
null
categories 
[
    "file-disclosure"
]