CVE-2026-72814 actix-files before 0.6.10 Information Disclosure via Files
Attackers can access unintended files by exploiting path resolution flaws when serving from non-existent folders in actix-files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72814?
CVE-2026-72814 is a medium-severity path traversal vulnerability in actix-files, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files.
Weakness: CWE-22
Which versions are affected by CVE-2026-72814?
2 open source packages ship an affected version, including actix-files.
| Package | Affected | Fixed in |
|---|---|---|
actix-files crates.io | All versions | 0.6.10 |
actix-files crates.io | All versions | 0.6.10 |
How do I fix CVE-2026-72814?
Upgrade actix-files to 0.6.10 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72814 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72814 exists.
Sources
Also known as CLEANSTART-2026-QW59159, GHSA-8v2v-wjwg-vx6r, GHSA-f87p-3w4v-5q9x, UBUNTU-CVE-2026-72814.