EUVD-2026-58629
GHSA-f87p-3w4v-5q9x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects that exploitation requires a specific developer misconfiguration (non-existent serve_from path) outside attacker control; C:L captures read-only access to working-directory files with no integrity or availability impact.
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files.
AnalysisAI
Path traversal in the actix-files Rust crate (versions 0.6.9 and earlier) exposes arbitrary files from the application's working directory to unauthenticated remote attackers. When Files::new() receives a non-existent serve_from directory, the library silently substitutes an empty base path; subsequent requests join attacker-supplied filenames against this empty root, which Rust's canonicalize() resolves relative to the process working directory, enabling direct file disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires exactly one precondition: the application must call `actix_files::Files::new()` with a `serve_from` argument pointing to a directory path that does not exist on the filesystem at the time the actix server initializes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) characterizes this as network-exploitable and unauthenticated, with a low confidentiality impact and an explicit attack requirement (AT:P): exploitation is contingent on the developer having misconfigured `Files::new()` with a non-existent `serve_from` path, a condition beyond the attacker's control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scanning actix-web services discovers that a static file endpoint responds to path-traversal-style GET requests with file contents rather than 404 errors, confirming the empty-base-path fallback is active. Using the public PoC at https://github.com/Angelmmiguel/actix-files-vuln as a template, the attacker sends requests such as `GET /images/Cargo.toml` and `GET /images/.env` to the server, which resolves these filenames relative to the application's working directory and returns their contents directly in the HTTP response. … |
| Remediation | Upgrade actix-files to version 0.6.10, which is the vendor-released patch confirmed by advisory GHSA-8v2v-wjwg-vx6r at https://github.com/actix/actix-web/security/advisories/GHSA-8v2v-wjwg-vx6r. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote process termination in actix-files 0.6.9 and earlier allows any unauthenticated network attacker to crash a Rust
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to de
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Not-Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Not-Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today