RUSTSEC-2026-0443

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0443

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0443.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0443

Aliases

GHSA-8hcm-m7r7-frwc

Published

2026-11-06T12:00:00Z

Modified

2026-11-06T14:45:02Z

Summary

Hidden file disclosure through Windows short names

Details

On Windows volumes with 8.3 short names, actix_files::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.

A remote client can read files such as .env or .git/config in the served directory even when use_hidden_files() is not enabled. This can expose secrets or source code.

Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / actix-files

Package

Name: actix-files; View open source insights on deps.dev
Purl: pkg:cargo/actix-files

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.7.4

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": [
            "windows"
        ]
    }
}