RUSTSEC-2026-0276 Path traversal in apimock-server's file-serving fallback
Attackers can read arbitrary files via path traversal in apimock-server if bound to a network interface, requiring a client that preserves dot-dot segments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0276?
RUSTSEC-2026-0276 is a path traversal vulnerability in apimock, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The file-serving fallback joined a request-derived path onto the
configured response directory and checked only that the result existed,
never that it stayed inside that directory. A request containing a raw
.. segment could read any file readable by the process, returned with
HTTP 200.
Read-only: no write, no code execution.
Exposure depends on the bind address. The default is 127.0.0.1;
deployments binding 0.0.0.0 or a LAN address are reachable from the
network. Most HTTP clients normalise .. away before sending, so
reaching it requires a client that does not.
All published versions before 5.19.1 are affected. Fixed in 5.19.1 by canonicalising each resolved path and rejecting anything outside its base directory.
This advisory also covers apimock 5.x, which depends on
apimock-server. apimock 4.x predates the crate split and carries its
own advisory for the same issue, fixed in 4.8.1.
Which versions are affected by RUSTSEC-2026-0276?
2 open source packages ship an affected version, including apimock and apimock-server.
| Package | Affected | Fixed in |
|---|---|---|
apimock crates.io | From 0.0.0-0 | 4.8.1, 5.0.0 |
apimock-server crates.io | From 0.0.0-0 | 5.19.1 |
How do I fix RUSTSEC-2026-0276?
Upgrade apimock to a fixed version for your release line: 4.8.1 or 5.0.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is RUSTSEC-2026-0276 being exploited?
There is no known exploitation of RUSTSEC-2026-0276 in the wild and no public exploit code.
Sources
Also known as GHSA-72g6-wgrg-vhm7, RUSTSEC-2026-0277.