GHSA-7p7c-pvvx-2vx3
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
What each source reports
GitHub AdvisoriesNo score
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-7p7c-pvvx-2vx3- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-7p7c-pvvx-2vx3- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVRUSTSEC-2022-0069No score
Improper validation of Windows paths could lead to directory traversal attack
Path resolution in hyper-staticfile didn't correctly validate Windows paths
meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
RUSTSEC-2022-0069- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hyper-staticfilecrates.io | before 0.9.2 | 0.9.2 |
hyper-staticfilecrates.io | 0.10.0-alpha.1 to 0.10.0-alpha.1 | 0.10.0-alpha.2 |
hyper-staticfilecrates.io | 0.10.0-alpha.1 up to 0.10.0-alpha.2 | 0.10.0-alpha.2 |
hyper-staticfilecrates.io | 0.0.0-0 up to 0.9.2, 0.10.0-0 up to 0.10.0-alpha.2 | 0.9.20.10.0-alpha.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7p7c-pvvx-2vx3 is a vulnerability with no CVSS score yet in hyper-staticfile, published November 30, 2022. No source lists public exploit code. Fixed in hyper-staticfile 0.9.2.
References
github.com/stephank/hyper-staticfile/issues/35
rustsec.org/advisories/RUSTSEC-2022-0069.html
crates.io/crates/hyper-staticfile