Local file inclusion In actix-files
Description
Hidden file disclosure through Windows short names
On Windows volumes with 8.3 short names, actix_files::Files can serve hidden
files through their short-name aliases. The default path check rejects segments
that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.
A remote client can read files such as .env or .git/config in the served
directory even when use_hidden_files() is not enabled. This can expose secrets
or source code.
Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 cargo | 0.7.4 |
Aliases
1. 2. 3.
References
1.