What is CVE-2026-72814?
This vulnerability in `actix-files` crate before version 0.6.10 leads to information exposure. When a non-existing folder is passed as the `serve_from` argument to `Files::new()`, the mount path incorrectly defaults to an empty path, potentially allowing access to unintended files on the system. Affected applications should immediately upgrade to version 0.6.10 or later.
Azərbaycanca: Bu boşluq `actix-files` sandığının 0.6.10-dan əvvəlki versiyalarında məlumat sızmasına səbəb olur. `serve_from` arqumenti olaraq mövcud olmayan qovluq verildikdə, mount yolu səhvən boş qalır və xidmət fayl sistemində gözlənilməz fayllara çıxış imkanı yaradır. Təsirə məruz qalan tətbiqlər dərhal `actix-files` versiyasını 0.6.10 və ya daha yenisinə yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-200
FAQ2
How to protect against CVE-2026-72814 vulnerability in the `actix-files` crate?
Affected applications should immediately upgrade to version 0.6.10 or later.
Under what condition does CVE-2026-72814 lead to information exposure?
When a non-existing folder is passed as the `serve_from` argument, the mount path incorrectly defaults to an empty path, potentially allowing access to unintended files on the system.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.