This advisory has been withdrawn and should be ignored. It is kept only for reference.
- Affected OSes
tower_http::services::fs::ServeDir didn't correctly validate Windows paths
meaning paths like
/foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of
c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.