Information Exposure in Actix Files Crate by Actix Company
CVE-2026-72814

6.3MEDIUM

Key Information:

Vendor

Actix

Status
Actix-web
Vendor
CVE Published:
14 August 2026

What is CVE-2026-72814?

The actix-files crate prior to version 0.6.10 is susceptible to an information exposure vulnerability. When a non-existing folder is specified as the serve_from argument in Files::new(), the service defaults to an empty mount path. This can allow attackers to manipulate request paths, as the application resolves these paths relative to its working directory. Consequently, unauthorized access to sensitive files may occur, leading to potential data breaches. It's crucial for users to upgrade to the latest version to mitigate this risk.

Affected Version(s)

actix-web 0 < 0.6.10

actix-web 0.6.10

References

https://github.com/actix/actix-web/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/actix-web-before-inf...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Angelmmiguel
JohnTitor
.