# actix-files hidden file disclosure through Windows short names

Source: https://junglewise.ai/threats/rustsec-2026-0443-hidden-file-disclosure-through-windows-short-names-c06f4e77  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-06

actix-files is a Rust web framework library that serves static files over HTTP. On Windows systems, an attacker can read hidden files like .env or .git/config by requesting them using their Windows 8.3 short-name aliases (e.g., ENV~1), bypassing the library's dot-file filtering mechanism. This exposes sensitive configuration data and source code even when the application does not explicitly allow access to hidden files.

Technologies: [actix-files (crates.io)](https://junglewise.ai/threats/technologies/actix-files). Vendors: [Actix](https://junglewise.ai/threats/vendors/actix), [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Actix-Files before 0.7.4; actix-files (crates.io) SEMVER:introduced=0.0.0-0,fixed=0.7.4.

**Is there a fix for This vulnerability?** Yes. actix-files (crates.io): upgrade to 0.7.4 or later. Until then: As a workaround, remove sensitive files and directories (such as .env and .git) from the served directory. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Actix-Files or actix-files (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actix-files (crates.io): upgrade to 0.7.4 or later

  ```sh
  cargo update -p actix-files
  ```


As a workaround, remove sensitive files and directories (such as .env and .git) from the served directory.

## Technical details

The vulnerability is a path traversal bypass in actix-files' default path validation on Windows. The library checks for and rejects path segments starting with a dot, but Windows 8.3 short-name aliases circumvent this check. A remote, unauthenticated attacker can request hidden files through their aliases to retrieve secrets and source code; the fix exists in version 0.7.4 and later.

## Affected products

- Actix actix-files before 0.7.4

## Identifiers

- GHSA-8hcm-m7r7-frwc
- RUSTSEC-2026-0443

## Timeline

- 2026-11-06: disclosed
- 2026-11-06: patched

## References

- [https://crates.io/crates/actix-files](https://crates.io/crates/actix-files)
- [https://rustsec.org/advisories/RUSTSEC-2026-0443.html](https://rustsec.org/advisories/RUSTSEC-2026-0443.html)

## Related threats

- [actix-files has a possible exposure of information vulnerability](https://junglewise.ai/threats/cve-2026-72814-actix-files-has-a-possible-exposure-of-information-vulnerability)
- [[actix-files] Panic triggered by empty Range header in GET request for static file](https://junglewise.ai/threats/cve-2026-72813-actix-files-panic-triggered-by-empty-range-header-in-get-request)