RUSTSEC-2026-0443

    Dashboard / Vulnerabilities / RUSTSEC-2026-0443

    RUSTSEC-2026-0443

    Published: 6 Nov 2026Last Modified: 6 Nov 2026

    Summary: Hidden file disclosure through Windows short names

    Details: On Windows volumes with 8.3 short names, `actix_files::Files` can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as `ENV~1` or `GIT~1` passes this check. A remote client can read files such as `.env` or `.git/config` in the served directory even when `use_hidden_files()` is not enabled. This can expose secrets or source code. Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.

    References: https://crates.io/crates/actix-files, https://rustsec.org/advisories/RUSTSEC-2026-0443.html, https://github.com/actix/actix-web/commit/f2c83122d244e4ba38514ee3fe1fd42a110dc3f0

    Affected packages

    Package

    Name: actix-files

    Purl: pkg:cargo/actix-files

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.0.0-0
    Fixed -0.7.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2026-0443 | CVE-DB