GHSA-8hcm-m7r7-frwc: Hidden file disclosure through Windows short names

Q: Which deployments are exposed to this issue?

Deployments using actix_files::Files on Windows volumes where 8.3 short names are available are exposed if the served directory contains hidden files or directories. The issue can occur even when use_hidden_files() is not enabled.

Q: What does an attacker need to exploit it?

An attacker only needs remote access to request content from the affected file-serving endpoint and knowledge or a guess of a hidden file's Windows short-name alias, such as ENV~1 or GIT~1. The alias bypasses the check that blocks path segments beginning with a dot.

Q: What could be exposed?

Hidden files within the served directory may be read remotely, including .env files and .git/config. This can disclose secrets or source code.

Q: What should be done if an immediate upgrade is not possible?

Remove sensitive files and directories from the directory served by actix_files::Files. Upgrade to actix-files 0.7.4 or later when possible.

Published Nov 6, 2026

Updated

On Windows volumes with 8.3 short names, actixfiles::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.

A remote client can read files such as .env or .git/config in the served directory even when usehiddenfiles() is not enabled. This can expose secrets or source code.

Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.

Affected Software

1 affected componentFixes available

rust/actix-files>=0.0.0-0<0.7.4

0.7.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/actix-files to a version that resolves this vulnerability.
Fixed in 0.7.4
Upgrade
Upgrade actix-files to a version that resolves this vulnerability.
Fixed in 0.7.4
Compensating control
Remove sensitive files such as .env and .git/config from the served directory.

Event History

Nov 6, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using actix_files::Files on Windows volumes where 8.3 short names are available are exposed if the served directory contains hidden files or directories. The issue can occur even when use_hidden_files() is not enabled.

What does an attacker need to exploit it?

An attacker only needs remote access to request content from the affected file-serving endpoint and knowledge or a guess of a hidden file's Windows short-name alias, such as ENV~1 or GIT~1. The alias bypasses the check that blocks path segments beginning with a dot.

What could be exposed?

Hidden files within the served directory may be read remotely, including .env files and .git/config. This can disclose secrets or source code.

What should be done if an immediate upgrade is not possible?

Remove sensitive files and directories from the directory served by actix_files::Files. Upgrade to actix-files 0.7.4 or later when possible.

GHSA-8hcm-m7r7-frwc: Hidden file disclosure through Windows short names

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could be exposed?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could be exposed?

What should be done if an immediate upgrade is not possible?