---
id: RUSTSEC-2026-0277
aliases:
  - GHSA-72g6-wgrg-vhm7
  - RUSTSEC-2026-0276
title: Path traversal in apimock-server's file-serving fallback
summary: Path traversal in apimock-server's file-serving fallback
severity: none
vendor: apimock-server
product: apimock-server
ecosystem: rust
affected:
  - 'apimock-server >= 0.0.0-0, < 5.19.1'
patched:
  - apimock-server 5.19.1
published: '2026-08-26'
updated: '2026-09-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0277'
references:
  - url: 'https://crates.io/crates/apimock-server'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0277.html'
  - url: >-
      https://github.com/apimokka/apimock-rs/commit/ff0dd152ecfccb3bf00e15cc92bd4d57e485c854
tags:
  - osv
  - rust
ingestedAt: '2026-09-02T19:31:28.185Z'
---

## Overview

The file-serving fallback joined a request-derived path onto the
configured response directory and checked only that the result existed,
never that it stayed inside that directory. A request containing a raw
`..` segment could read any file readable by the process, returned with
HTTP 200.

Read-only: no write, no code execution.

Exposure depends on the bind address. The default is `127.0.0.1`;
deployments binding `0.0.0.0` or a LAN address are reachable from the
network. Most HTTP clients normalise `..` away before sending, so
reaching it requires a client that does not.

All published versions before 5.19.1 are affected. Fixed in 5.19.1 by
canonicalising each resolved path and rejecting anything outside its
base directory.

**This advisory also covers `apimock` 5.x**, which depends on
`apimock-server`. `apimock` 4.x predates the crate split and carries its
own advisory for the same issue, fixed in 4.8.1.

## Affected packages

- `apimock-server >= 0.0.0-0, < 5.19.1`

## Remediation

Upgrade to a patched release:

- `apimock-server 5.19.1`