Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

apimock-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2crates.ioAmendedPublished

    Path traversal in apimock-server's file-serving fallback

    GHSA-72g6-wgrg-vhm7

    Affected
    • crates.io apimock-server >= 0.0.0-0, < 5.19.1
    Fixed in
    5.19.1· Vendor fix available
    Issue
    The file-serving fallback joined a request-derived path onto the configured response directory and checked only that the result existed, never that it stayed inside that directory. A request containing a raw `..` segment could read any file readable by the process, returned with HTTP 200. Read-only: no write, no code execution. Exposure depends on the bind address. The default is `127.0.0.1`; deployments binding `0.0.0.0` or a LAN address are reachable from the network. Most HTTP clients normalise `..` away before sending, so reaching it requires a client that does not. All published versions before 5.19.1 are affected. Fixed in 5.19.1 by canonicalising each resolved path and rejecting anything outside its base directory. This advisory also covers `apimock` 5.x, which depends on `apimock-server`. `apimock` 4.x predates the crate split and carries its own advisory for the same issue, fixed in 4.8.1.

    Recommended action: Upgrade to 5.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)Source checked Evidence →