Reported

November 6, 2026

Issued

November 6, 2026

Package

actix-files (crates.io)

Type

Vulnerability

Aliases

• GHSA-8hcm-m7r7-frwc

References

• https://github.com/actix/actix-web/commit/f2c83122d244e4ba38514ee3fe1fd42a110dc3f0

Patched

• >=0.7.4

Affected OSes

• windows

Description

On Windows volumes with 8.3 short names, actix_files::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.

A remote client can read files such as .env or .git/config in the served directory even when use_hidden_files() is not enabled. This can expose secrets or source code.

Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.

Advisory available under CC0-1.0 license.