Reported

November 30, 2022

Issued

November 30, 2022 (last modified: June 13, 2023)

Package

hyper-staticfile (crates.io)

Type

Vulnerability

Categories

• file-disclosure

Keywords

#directory-traversal #http

Aliases

• GHSA-7p7c-pvvx-2vx3

References

• https://github.com/stephank/hyper-staticfile/issues/35

Patched

• ^0.9.2
• >=0.10.0-alpha.2

Affected OSes

• windows

Description

Path resolution in hyper-staticfile didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Advisory available under CC0-1.0 license.