GHSA-cgw6-f3mj-h742: RustEmbed generated `get` method allows for directory traversal when reading files from disk
When running in debug mode and the debug-embed
(off by default) feature is
not enabled, the generated get
method does not check that the input path is
a child of the folder given.
This allows attackers to read arbitrary files in the file system if they have
control over the filename given. The following code will print the contents of
your /etc/passwd
if adjusted with a correct number of ../
s depending on
where it is run from.
References
Detect and mitigate GHSA-cgw6-f3mj-h742 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →