CVE-2026-72814
Received Received - Intake

actix-files Path Traversal Information Exposure

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72814
EUVD
EUVD-2026-58629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
actix actix-files to 0.6.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information exposure issue in the actix-files crate before version 0.6.10. When a non-existing folder is passed to Files::new(), the mount path becomes empty. The service then joins the request path with this empty path and resolves it as a relative path, allowing attackers to access unintended files in the application's working directory.

Detection Guidance

Check if your application uses actix-files version 0.6.9 or earlier. Inspect server logs for unusual file access patterns or requests to non-standard paths. Test by attempting to access files outside the intended directory using crafted URLs.

Impact Analysis

An attacker could exploit this to access sensitive files outside the intended directory, such as configuration files or source code. This could lead to data leaks, unauthorized access to credentials, or exposure of proprietary information. The attack requires no privileges or user interaction and has low complexity.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data, such as personal or health information, to unauthorized parties. GDPR and HIPAA mandate strict controls to protect such data, and a breach could result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update actix-files to version 0.6.10 or later immediately. If updating is not possible, remove or restrict access to the Files::new() method with non-existent folders. Review server configurations to ensure path resolution is secure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart