https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 06 Nov 2026 15:39:54 +0000 https://db.gcve.eu/vuln/rustsec-2021-0135 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: tower-http</p> <p>`tower_http::services::fs::ServeDir` didn&#39;t correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.</p> <p>This only impacts Windows. Linux and other unix likes are not impacted by this.</p> <p>See [tower-http#204] for more details.</p> <p>[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: tower-http</p> <p>`tower_http::services::fs::ServeDir` didn&#39;t correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.</p> <p>This only impacts Windows. Linux and other unix likes are not impacted by this.</p> <p>See [tower-http#204] for more details.</p> <p>[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204</p> https://db.gcve.eu/vuln/rustsec-2021-0135