The actix-files crate for Rust has a vulnerability where hidden files on Windows volumes using 8.3 short names can be accessed via their short-name aliases. This bypasses the default path check that blocks dot-prefixed segments, allowing remote clients to read sensitive files like .env or .git/config even if hidden files are not enabled. This can lead to exposure of secrets or source code. The issue is fixed in actix-files version 0.7.4.