actix-files CVE-2026-72814

Exploitation requires exactly one precondition: the application must call actix_files::Files::new() with a serve_from argument pointing to a directory path that does not exist on the filesystem at the time the actix server initializes. This triggers the silent empty-path fallback in actix-files/src/files.rs:L104 - correctly configured deployments where the serve_from directory exists at startup are entirely unaffected. Once this misconfiguration is present, no authentication is required (PR:N in the CVSS 4.0 vector), no special HTTP headers are needed, and no user interaction is involved; any network-reachable HTTP client can trigger file disclosure with a standard GET request to the mounted path. Exploitation is bounded by: (1) the misconfiguration precondition being present (AT:P), which the attacker cannot induce but can discover through source code review, error messages, or behavioral fingerprinting; (2) the filesystem visibility of the application process - only files readable by the process user in or beneath the working directory are accessible; and (3) the attacker's ability to enumerate file paths, which is aided if directory listing is enabled or source layout is predictable.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) characterizes this as network-exploitable and unauthenticated, with a low confidentiality impact and an explicit attack requirement (AT:P): exploitation is contingent on the developer having misconfigured Files::new() with a non-existent serve_from path, a condition beyond the attacker's control. This AT:P signal is the single most important limiting factor - correctly configured deployments are entirely unaffected. EPSS data was not provided in the input, so statistical exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. However, the existence of a public PoC repository (https://github.com/Angelmmiguel/actix-files-vuln) substantially lowers the barrier for exploitation once a misconfigured deployment is identified via recon or source code disclosure. Despite the CVSS VC:L rating, real-world confidentiality harm may be significantly higher if the working directory contains .env files, Cargo.toml manifests, private keys, or database credentials - the VC:L floor should not be misread as a ceiling. Even a mid-sized municipal IT team in gdynia running an actix-web service whose static-file directory is conditionally created at runtime should treat this as high-priority remediation given the trivial exploit path once the misconfiguration is present.

An attacker scanning actix-web services discovers that a static file endpoint responds to path-traversal-style GET requests with file contents rather than 404 errors, confirming the empty-base-path fallback is active. Using the public PoC at https://github.com/Angelmmiguel/actix-files-vuln as a template, the attacker sends requests such as GET /images/Cargo.toml and GET /images/.env to the server, which resolves these filenames relative to the application's working directory and returns their contents directly in the HTTP response. If the working directory contains an .env file holding database credentials, API secrets, or private keys, those are fully exposed without any authentication or special tooling.