{"id":"GHSA-72g6-wgrg-vhm7","aliases":["RUSTSEC-2026-0276","RUSTSEC-2026-0277"],"status":"published","title":"Path traversal in apimock's file-serving fallback","description":"The file-serving fallback joined a request-derived path onto the\nconfigured response directory and checked only that the result existed,\nnever that it stayed inside that directory. A request containing a raw\n`..` segment could read any file readable by the process, returned with\nHTTP 200.\n\nRead-only: no write, no code execution.\n\nOn the 4.x line `apimock` is a single crate containing the serving code.\nFixed in 4.8.1 by canonicalising each resolved path and rejecting\nanything outside its base directory.\n\n**apimock 5.0.0 and later are not affected by this advisory.** From\n5.0.0 the serving code moved to the `apimock-server` crate, which\n`apimock` depends on; that crate carries its own advisory for the same\nissue, fixed in 5.19.1.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-26T12:00:00Z","modified":"2026-09-02T09:10:39Z","fixes":[{"ecosystem":"crates.io","package":"apimock","fixed_in":["4.8.1","5.0.0"],"sources":["osv"]},{"ecosystem":"crates.io","package":"apimock-server","fixed_in":["5.19.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"apimock","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"4.8.1"},{"introduced":"5.0.0"},{"fixed":"5.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"apimock-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"5.19.1"}]}]}],"references":[{"url":"https://crates.io/crates/apimock","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0276.html","tags":["advisory"]},{"url":"https://github.com/apimokka/apimock-rs/commit/a9c05fec2d36a750c30e797291a0557f230c8faf","tags":["web"]},{"url":"https://crates.io/crates/apimock-server","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0277.html","tags":["advisory"]},{"url":"https://github.com/apimokka/apimock-rs/commit/ff0dd152ecfccb3bf00e15cc92bd4d57e485c854","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0276","title":"Path traversal in apimock's file-serving fallback","description":"The file-serving fallback joined a request-derived path onto the\nconfigured response directory and checked only that the result existed,\nnever that it stayed inside that directory. A request containing a raw\n`..` segment could read any file readable by the process, returned with\nHTTP 200.\n\nRead-only: no write, no code execution.\n\nOn the 4.x line `apimock` is a single crate containing the serving code.\nFixed in 4.8.1 by canonicalising each resolved path and rejecting\nanything outside its base directory.\n\n**apimock 5.0.0 and later are not affected by this advisory.** From\n5.0.0 the serving code moved to the `apimock-server` crate, which\n`apimock` depends on; that crate carries its own advisory for the same\nissue, fixed in 5.19.1.","status":"published","published":"2026-08-26T12:00:00Z","modified":"2026-09-02T09:10:39.45001621Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"RUSTSEC-2026-0277","title":"Path traversal in apimock-server's file-serving fallback","description":"The file-serving fallback joined a request-derived path onto the\nconfigured response directory and checked only that the result existed,\nnever that it stayed inside that directory. A request containing a raw\n`..` segment could read any file readable by the process, returned with\nHTTP 200.\n\nRead-only: no write, no code execution.\n\nExposure depends on the bind address. The default is `127.0.0.1`;\ndeployments binding `0.0.0.0` or a LAN address are reachable from the\nnetwork. Most HTTP clients normalise `..` away before sending, so\nreaching it requires a client that does not.\n\nAll published versions before 5.19.1 are affected. Fixed in 5.19.1 by\ncanonicalising each resolved path and rejecting anything outside its\nbase directory.\n\n**This advisory also covers `apimock` 5.x**, which depends on\n`apimock-server`. `apimock` 4.x predates the crate split and carries its\nown advisory for the same issue, fixed in 4.8.1.","status":"published","published":"2026-08-26T12:00:00Z","modified":"2026-09-02T09:10:39.45001621Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:53:40.430679Z"}]}}