{"id":"GHSA-3227-r97m-8j95","aliases":[],"status":"published","title":"Relative Path Traversal in afire serve_static","description":"### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(\u0026self, req: Request) -\u003e MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(\u0026mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-34"],"published":"2022-04-22T20:16:45Z","modified":"2023-01-11T05:07:14Z","fixes":[{"ecosystem":"crates.io","package":"afire","fixed_in":["1.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"afire","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.1"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"afire","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.1"},{"fixed":"1.1.0"}]}]}],"references":[{"url":"https://github.com/Basicprogrammer10/afire/security/advisories/GHSA-3227-r97m-8j95","tags":["web"]},{"url":"https://github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921","tags":["web"]},{"url":"https://github.com/Basicprogrammer10/afire/releases/tag/v1.1.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3227-r97m-8j95"},{"url":"https://github.com/Basicprogrammer10/afire","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3227-r97m-8j95","title":"Relative Path Traversal in afire serve_static","description":"### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(\u0026self, req: Request) -\u003e MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(\u0026mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]","status":"published","published":"2022-04-22T20:16:45Z","modified":"2023-01-11T05:07:14Z","cwes":["CWE-22","CWE-34"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-3227-r97m-8j95","title":"Relative Path Traversal in afire serve_static","description":"### Impact\nThis vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.\n\n### Patches\nThe issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).\nIf you can, just update to the newest version of afire.\n\n### Workarounds\nIf you can't update afire you can simply disallow paths containing `/..` with the following middleware.\nMake sure this is the last middleware added to the server so it runs first, stopping the bad requests.\n```rust\nuse afire::prelude::*;\n\nstruct PathTraversalFix;\n\nimpl Middleware for PathTraversalFix {\n    fn pre(\u0026self, req: Request) -\u003e MiddleRequest {\n        if req.path.replace(\"\\\\\", \"/\").contains(\"/..\") {\n            return MiddleRequest::Send(\n                Response::new()\n                    .status(400)\n                    .text(\"Paths containing `..` are not allowed\"),\n            );\n        }\n\n        MiddleRequest::Continue\n    }\n}\n```\n```rust\nlet mut server = Server::new(host, port);\nPathTraversalFix.attach(\u0026mut server);\n```\n\n### References\nYou can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)\n\n### For more information\nIf you have any questions or comments about this advisory you can email me or message me on discord.\n[[https://connorcode.com/contact](https://connorcode.com/contact)]","status":"published","published":"2022-04-22T20:16:45Z","modified":"2022-04-22T20:16:45Z","cwes":["CWE-22","CWE-34"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}