GHSA-wwh2-r387-g5rm: tower-http's improper validation of Windows paths could lead to directory traversal attack
(updated )
tower_http::services::fs::ServeDir
didn’t correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png
would be allowed and respond with the contents of c:/windows/web/screen/img101.png
. Thus users could potentially read files anywhere on the filesystem. This only impacts Windows. Linux and other unix likes are not impacted by this.
References
Detect and mitigate GHSA-wwh2-r387-g5rm with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →