RUSTSEC-2026-0443: Hidden file disclosure through Windows short names

Q: Which deployments are exposed to this issue?

Deployments using actix_files::Files on Windows volumes where 8.3 short names are available are exposed if the served directory contains hidden files or directories. This can occur even when use_hidden_files() is not enabled.

Q: What does an attacker need to exploit it?

A remote client needs to be able to request files from the affected actix_files::Files handler and know or guess an 8.3 short-name alias for a hidden file or directory. Aliases such as ENV~1 or GIT~1 can bypass the check that blocks path segments beginning with a dot.

Q: What information could be exposed?

Hidden files within the served directory may be readable, including .env files and .git/config. This may expose secrets or source code.

Q: What can be done if upgrading is not immediately possible?

Remove sensitive files and directories from the directory served by actix_files::Files. The documented fix is to upgrade to actix-files 0.7.4 or later.

Published Nov 6, 2026

Updated

On Windows volumes with 8.3 short names, actixfiles::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV~1 or GIT~1 passes this check.

A remote client can read files such as .env or .git/config in the served directory even when usehiddenfiles() is not enabled. This can expose secrets or source code.

Upgrade to actix-files 0.7.4 or later. As a workaround, remove sensitive files and directories from the served directory.

Affected Software

1 affected componentFixes available

rust/actix-files>=0.0.0-0<0.7.4

0.7.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/actix-files to a version that resolves this vulnerability.
Fixed in 0.7.4
Upgrade
Upgrade actix-files to a version that resolves this vulnerability.
Fixed in 0.7.4
Remove
Remove the affected component from your environment.
Remove sensitive files such as .env and .git/config from the served directory.

Event History

Nov 6, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using actix_files::Files on Windows volumes where 8.3 short names are available are exposed if the served directory contains hidden files or directories. This can occur even when use_hidden_files() is not enabled.

What does an attacker need to exploit it?

A remote client needs to be able to request files from the affected actix_files::Files handler and know or guess an 8.3 short-name alias for a hidden file or directory. Aliases such as ENV~1 or GIT~1 can bypass the check that blocks path segments beginning with a dot.

What information could be exposed?

Hidden files within the served directory may be readable, including .env files and .git/config. This may expose secrets or source code.

What can be done if upgrading is not immediately possible?

Remove sensitive files and directories from the directory served by actix_files::Files. The documented fix is to upgrade to actix-files 0.7.4 or later.

RUSTSEC-2026-0443: Hidden file disclosure through Windows short names

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be exposed?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be exposed?

What can be done if upgrading is not immediately possible?