CVE-2026-72814 actix CVE debrief

Who should care

Defenders responsible for actix-files deployments should assess exposure and verify the version in use. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for reviewing and mitigating vulnerabilities.

Why it matters

Defenders should prioritize verifying the version of actix-files in use and upgrading to version 0.6.10 or later to mitigate this information exposure vulnerability. This vulnerability allows an attacker to access unintended files by requesting paths that resolve relative to the application's working directory.

• An attacker can request paths that resolve relative to the application's working directory and access unintended files.

Technical summary

The actix-files crate before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files. This vulnerability allows an attacker to access sensitive information by requesting paths that resolve relative to the application's working directory.

Defensive priority

Defenders should prioritize verifying the version of actix-files in use and upgrading to version 0.6.10 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the version of actix-files in use
• Upgrade to version 0.6.10 or later
• Review application configurations for serve_from arguments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and deployments is not explicitly stated. The advisory from Vulncheck provides additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.