GHSA-wwh2-r387-g5rm
tower-http's improper validation of Windows paths could lead to directory traversal attack
GHSA-wwh2-r387-g5rm is a vulnerability with no CVSS score yet in tower-http, published June 17, 2022. No source lists public exploit code. Fixed in tower-http 0.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.1tower-http +1 more
Description
tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tower-httpcrates.io | 0.2.0 up to 0.2.1 | 0.2.1 |
tower-httpcrates.io | before 0.1.3 | 0.1.3 |
What each source reports
GitHub AdvisoriesNo score
tower-http's improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-wwh2-r387-g5rm- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
tower-http's improper validation of Windows paths could lead to directory traversal attack
tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.
- Record
GHSA-wwh2-r387-g5rm- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.