Actix files: Hidden file disclosure through Windows short names
Affects actix-filesSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.7.4
Data as of 6 Nov 2026, 15:48 UTC
What to do
Upgrade actix-files to 0.7.4.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioactix-filespkg:cargo/actix-filesOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade actix-files to version 0.7.4 or later where this vulnerability is fixed. As a temporary workaround, remove sensitive files and directories from the served directory to prevent unauthorized access via short-name aliases.
Description
The actix-files crate for Rust has a vulnerability where hidden files on Windows volumes using 8.3 short names can be accessed via their short-name aliases. This bypasses the default path check that blocks dot-prefixed segments, allowing remote clients to read sensitive files like .env or .git/config even if hidden files are not enabled. This can lead to exposure of secrets or source code. The issue is fixed in actix-files version 0.7.4.