CVE-2026-72814

Name of the Vulnerable Software and Affected Versions actix-files versions prior to 0.6.10

Description An information exposure issue exists when a non-existing folder is provided as the serve from argument to the Files::new() function. In this scenario, the mount path defaults to an empty path, and the service joins the request path with this empty path and canonicalizes it. This causes Rust to resolve the request as a relative path, allowing an attacker to request paths relative to the application's working directory and access unintended files.

Recommendations Update actix-files to version 0.6.10 or later.