The actix-files component of actix-web does not correctly handle an absent directory passed to Files::new(). When the serve_from path does not exist the mount path defaults to an empty string, causing the framework to join the request URL with that empty path and then canonicalize the resulting path. The canonicalization resolves the path relative to the process’s working directory, allowing an attacker to reference files outside the intended static file directory. The flaw enables unintended file reads, which can expose sensitive application data. This weakness corresponds to CWE‑22.

The vulnerability affects the actix-web library from the Actix project. Any version of actix-web that incorporates actix-files before release 0.6.10 is impacted. Applications dependent on actix-web 0.6.9 or earlier, or any project that uses actix-files <0.6.10, are at risk when an attacker can send crafted HTTP requests to the file-serving endpoint.

With a CVSS score of 6.3 the flaw presents moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting limited observed exploitation. Nevertheless, the weakness can be triggered by any external client that can send requests to the file-serving route, making remote attackers capable of disclosure. Based on the description, it is inferred that the attack vector is external over the network. Given the lack of defensive barriers in the vulnerable code, realizing the disclosure requires only normal HTTP access to the server.