Headline

GHSA-wwh2-r387-g5rm: Improper validation of Windows paths could lead to directory traversal attack

tower_http::services::fs::ServeDir didn’t correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See tower-http#204 for more details.

2 years ago

ghsa

Open in Source

#web #windows #linux #git

tower_http::services::fs::ServeDir didn’t correctly validate Windows paths
meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See tower-http#204 for more details.

References