tower-rs/tower-http · Security
tower-http's improper validation of Windows paths could lead to directory traversal attack
- GHSA ID
- GHSA-wwh2-r387-g5rm
- Severity
- medium
- Published
- Updated
Description
tower_http::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')