---
id: RUSTSEC-2026-0276
aliases:
  - GHSA-72g6-wgrg-vhm7
  - RUSTSEC-2026-0277
title: Path traversal in apimock's file-serving fallback
summary: Path traversal in apimock's file-serving fallback
severity: none
vendor: apimock
product: apimock
ecosystem: rust
affected:
  - 'apimock >= 5.0.0, < 5.0.0'
patched:
  - apimock 5.0.0
published: '2026-08-26'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0276'
references:
  - url: 'https://crates.io/crates/apimock'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0276.html'
  - url: >-
      https://github.com/apimokka/apimock-rs/commit/a9c05fec2d36a750c30e797291a0557f230c8faf
tags:
  - osv
  - rust
ingestedAt: '2026-09-02T19:31:28.144Z'
---

## Overview

The file-serving fallback joined a request-derived path onto the
configured response directory and checked only that the result existed,
never that it stayed inside that directory. A request containing a raw
`..` segment could read any file readable by the process, returned with
HTTP 200.

Read-only: no write, no code execution.

On the 4.x line `apimock` is a single crate containing the serving code.
Fixed in 4.8.1 by canonicalising each resolved path and rejecting
anything outside its base directory.

**apimock 5.0.0 and later are not affected by this advisory.** From
5.0.0 the serving code moved to the `apimock-server` crate, which
`apimock` depends on; that crate carries its own advisory for the same
issue, fixed in 5.19.1.

## Affected packages

- `apimock >= 5.0.0, < 5.0.0`

## Remediation

Upgrade to a patched release:

- `apimock 5.0.0`