CVE-2026-72814: Actix Actix-Web

Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files.

Affected products

• Actix Actix-Web: before 0.6.10 (fixed in 0.6.10)

Published 2026-08-14. Last modified 2026-09-24.