CVE-2026-72814 actix-web before 0.6.10 Information Disclosure via Files

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

abacuz (>=0.1.0, <=0.1.1), acceptxmr (>=0.1.0, <=0.13.0) +167 more potentially affected by CVE-2026-72814 via actix-files (>=0.1.0-alpha.6, <=0.6.6)

actix-files CARGO version =0.1.0-alpha.6, =0.1.0, =0.1.0, =1.0.0-alpha.6, =0.3.0, =0.9.0, =0.1.0, =0.1.0, =3.6.0, =0.6.0, =0.34.0 - bassment 0.1.0 - boltserver 0.11.11 and more Source cves: CVE-2026-72814 Source advisory: OSV:GHSA-8V2V-WJWG-VX6R...