https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 23:17:28 +0000 https://db.gcve.eu/vuln/ghsa-8v2v-wjwg-vx6r <p><strong>Affected:</strong> crates.io: actix-files</p> <p>### Summary</p> <p>When passing a non-existing folder to the `actix_files::Files::new()` method causes the actix server to expose unexpected files.</p> <p>### Details</p> <p>The `actix-files` library exposes a [`Files` struct](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L38) that configures an actix `service` to serve the files in a folder as static assets. Below you can find the [signature of the `Files::new` method](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L98):</p> <p>```rust pub fn new&lt;T: Into&lt;PathBuf&gt;&gt;(mount_path: &amp;str, serve_from: T) -&gt; Files ```</p> <p>When the `mount_path` you pass to `Files` doesn&#39;t exist, [it defaults to an empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L104) (`Path::new()`). When the service receives a HTTP request, it [joins the request information with the empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/service.rs#L136) and calls `canonicalize`. Rust resolves this path as relative and returns any file that matches it.</p> <p>This behavior causes the library to expose unexpected files when the folder is not present.</p> <p>### PoC</p> <p>_There is a working PoC on https://github.com/Angelmmiguel/actix-files-vuln, although the next steps can be followed to reproduce the issue_</p> <p>1. Clone the https://github.com/actix/examples repository. 2. C…</p> <p><strong>Affected:</strong> crates.io: actix-files</p> <p>### Summary</p> <p>When passing a non-existing folder to the `actix_files::Files::new()` method causes the actix server to expose unexpected files.</p> <p>### Details</p> <p>The `actix-files` library exposes a [`Files` struct](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L38) that configures an actix `service` to serve the files in a folder as static assets. Below you can find the [signature of the `Files::new` method](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L98):</p> <p>```rust pub fn new&lt;T: Into&lt;PathBuf&gt;&gt;(mount_path: &amp;str, serve_from: T) -&gt; Files ```</p> <p>When the `mount_path` you pass to `Files` doesn&#39;t exist, [it defaults to an empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L104) (`Path::new()`). When the service receives a HTTP request, it [joins the request information with the empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/service.rs#L136) and calls `canonicalize`. Rust resolves this path as relative and returns any file that matches it.</p> <p>This behavior causes the library to expose unexpected files when the folder is not present.</p> <p>### PoC</p> <p>_There is a working PoC on https://github.com/Angelmmiguel/actix-files-vuln, although the next steps can be followed to reproduce the issue_</p> <p>1. Clone the https://github.com/actix/examples repository. 2. C…</p> https://db.gcve.eu/vuln/ghsa-8v2v-wjwg-vx6r