Skip to content
OpenAdvisories

Package · crates.io

tower-http

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-qrqq-9c63-xfrg

    tower-http's improper validation of Windows paths could lead to directory traversal attack

    `tower_http::services::fs::ServeDir` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially rea…

    tower-http crates.io
  • Medium —
    GHSA-wwh2-r387-g5rm

    tower-http's improper validation of Windows paths could lead to directory traversal attack

    `tower_http::services::fs::ServeDir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read…

    tower-http crates.io