GHSA-qrqq-9c63-xfrg
tower-http's improper validation of Windows paths could lead to directory traversal attack
GHSA-qrqq-9c63-xfrg is a vulnerability with no CVSS score yet in tower-http, published January 21, 2022. No source lists public exploit code. Fixed in tower-http 0.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.1tower-http +3 more
Description
tower_http::services::fs::ServeDir didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tower-httpcrates.io | 0.2.0 to 0.2.0 | 0.2.1 |
tower-httpcrates.io | before 0.1.3 | 0.1.3 |
tower-httpcrates.io | 0.2.0 up to 0.2.1 | 0.2.1 |
tower-httpcrates.io | 0.0.0-0 up to 0.1.3, 0.2.0 up to 0.2.1 | 0.1.30.2.1 |
What each source reports
GitHub AdvisoriesNo score
tower-http's improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
- Record
GHSA-qrqq-9c63-xfrg- Updated
- 2026-11-02
OSVNo score
tower-http's improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn't correctly validate Windows paths, meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
- Record
GHSA-qrqq-9c63-xfrg- Updated
- 2026-11-02
OSVRUSTSEC-2022-0043No score
Improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn't correctly validate Windows paths
meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.
This only impacts Windows. Linux and other unix likes are not impacted by this.
See tower-http#204 for more details.
- Record
RUSTSEC-2022-0043- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.