{"id":"GHSA-8hcm-m7r7-frwc","aliases":["RUSTSEC-2026-0443"],"status":"published","title":"Hidden file disclosure through Windows short names","description":"On Windows volumes with 8.3 short names, `actix_files::Files` can serve hidden\nfiles through their short-name aliases. The default path check rejects segments\nthat start with a dot, but an alias such as `ENV~1` or `GIT~1` passes this check.\n\nA remote client can read files such as `.env` or `.git/config` in the served\ndirectory even when `use_hidden_files()` is not enabled. This can expose secrets\nor source code.\n\nUpgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files\nand directories from the served directory.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-06T12:00:00Z","modified":"2026-11-06T14:45:02Z","fixes":[{"ecosystem":"crates.io","package":"actix-files","fixed_in":["0.7.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"actix-files","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.4"}]}]}],"references":[{"url":"https://crates.io/crates/actix-files","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0443.html","tags":["advisory"]},{"url":"https://github.com/actix/actix-web/commit/f2c83122d244e4ba38514ee3fe1fd42a110dc3f0","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0443","title":"Hidden file disclosure through Windows short names","description":"On Windows volumes with 8.3 short names, `actix_files::Files` can serve hidden\nfiles through their short-name aliases. The default path check rejects segments\nthat start with a dot, but an alias such as `ENV~1` or `GIT~1` passes this check.\n\nA remote client can read files such as `.env` or `.git/config` in the served\ndirectory even when `use_hidden_files()` is not enabled. This can expose secrets\nor source code.\n\nUpgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files\nand directories from the served directory.","status":"published","published":"2026-11-06T12:00:00Z","modified":"2026-11-06T14:45:02.860532998Z","updated_at":"2026-11-06T14:57:06.730583Z"}]}}