HistoryEditJSON (OSV)

RUSTSEC-2022-0069

Improper validation of Windows paths could lead to directory traversal attack

Reported
Issued
Package
hyper-staticfile (crates.io)
Type
Vulnerability
Categories
Keywords
#directory-traversal #http
Aliases
References
Patched
  • ^0.9.2
  • >=0.10.0-alpha.2
Affected OSes
  • windows

Description

Path resolution in hyper-staticfile didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Advisory available under CC0-1.0 license.