Vulnerability RUSTSEC-2026-0443
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 hours ago
November 06, 2026 at 12:00 PM UTC
Hidden file disclosure through Windows short names
>=0.0.0-0 <0.7.4
>=0.0.0-0 <0.7.4
Summary
Hidden file disclosure through Windows short names
Details
On Windows volumes with 8.3 short names, actix_files::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.
A remote client can read files such as .env or .git/config in the served directory even when use_hidden_files() is not enabled. This can expose secrets or source code.
Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
9 months ago
[actix-files] Panic triggered by empty Range header in GET request for static file
<0.6.10 GHSA-gcqf-3g44-vc9p
<0.6.10 GHSA-gcqf-3g44-vc9p
Medium Risk
9 months ago
actix-files has a possible exposure of information vulnerability
<0.6.10 GHSA-8v2v-wjwg-vx6r
<0.6.10 GHSA-8v2v-wjwg-vx6r
Impacted packages
Timeline
Published
8 hours ago
November 06, 2026 at 12:00 PM UTC
Last Modified
5 hours ago
November 06, 2026 at 02:45 PM UTC