rust-embed

Version	Released
`8.12.0` unknown	Jul 08, 2026
`8.11.0` unknown	Jan 14, 2026
`8.10.0` unknown yanked	Jan 13, 2026
`8.9.0` unknown	Nov 02, 2025
`8.8.0` unknown	Oct 18, 2025
`8.7.2` unknown	May 14, 2025
`8.7.1` unknown	May 05, 2025
`8.7.0` unknown	Apr 10, 2025
`8.6.0` unknown	Feb 25, 2025
`8.5.0` unknown	Jul 09, 2024
`8.4.0` unknown	May 11, 2024
`8.3.0` unknown	Feb 26, 2024
`8.2.0` unknown	Dec 29, 2023
`8.1.0` unknown	Dec 08, 2023
`8.0.0` unknown	Aug 23, 2023
`6.8.1` unknown	Jun 30, 2023
`6.8.0` unknown	Jun 30, 2023
`6.7.0` unknown	Jun 08, 2023
`6.6.1` unknown	Mar 25, 2023
`6.6.0` unknown	Mar 05, 2023
`6.5.0` unknown yanked	Nov 22, 2022
`6.4.2` unknown	Oct 20, 2022
`6.4.1` unknown	Sep 12, 2022
`6.4.0` unknown	Apr 15, 2022
`6.3.0` unknown	Nov 28, 2021
`6.2.0` unknown 1 CVE	Sep 01, 2021
`6.1.0` unknown 1 CVE	Aug 31, 2021
`6.0.1` unknown 1 CVE	Aug 21, 2021
`6.0.0` unknown 1 CVE	Aug 01, 2021
`5.9.0` unknown 1 CVE	Jan 18, 2021
`5.8.0` unknown 1 CVE	Jan 06, 2021
`5.7.0` unknown 1 CVE	Dec 08, 2020
`5.6.0` unknown 1 CVE	Jul 19, 2020
`5.5.1` unknown 1 CVE	Mar 19, 2020
`5.5.0` unknown 1 CVE	Feb 26, 2020
`5.4.0` unknown 1 CVE	Feb 25, 2020
`5.3.0` unknown 1 CVE	Feb 15, 2020
`5.2.0` unknown 1 CVE	Dec 10, 2019
`5.1.0` unknown 1 CVE	Jul 10, 2019
`5.0.5` unknown yanked 1 CVE	Jul 09, 2019
`5.0.4` unknown yanked 1 CVE	Jul 09, 2019
`5.0.3` unknown yanked 1 CVE	Jul 09, 2019
`5.0.2` unknown yanked 1 CVE	Jul 09, 2019
`5.0.1` unknown 1 CVE	Jul 09, 2019
`5.0.0` unknown 1 CVE	Jul 05, 2019
`4.5.0` unknown 1 CVE	Jun 29, 2019
`4.4.0` unknown 1 CVE	May 13, 2019
`4.3.0` unknown 1 CVE	Jan 09, 2019
`4.2.0` unknown 1 CVE	Dec 03, 2018
`4.1.0` unknown 1 CVE	Oct 24, 2018

8.12.0 unknown

Jul 08, 2026

8.11.0 unknown

Jan 14, 2026

8.10.0 unknown yanked

Jan 13, 2026

8.9.0 unknown

Nov 02, 2025

8.8.0 unknown

Oct 18, 2025

8.7.2 unknown

May 14, 2025

8.7.1 unknown

May 05, 2025

8.7.0 unknown

Apr 10, 2025

8.6.0 unknown

Feb 25, 2025

8.5.0 unknown

Jul 09, 2024

8.4.0 unknown

May 11, 2024

8.3.0 unknown

Feb 26, 2024

8.2.0 unknown

Dec 29, 2023

8.1.0 unknown

Dec 08, 2023

8.0.0 unknown

Aug 23, 2023

6.8.1 unknown

Jun 30, 2023

6.8.0 unknown

Jun 30, 2023

6.7.0 unknown

Jun 08, 2023

6.6.1 unknown

Mar 25, 2023

6.6.0 unknown

Mar 05, 2023

6.5.0 unknown yanked

Nov 22, 2022

6.4.2 unknown

Oct 20, 2022

6.4.1 unknown

Sep 12, 2022

6.4.0 unknown

Apr 15, 2022

6.3.0 unknown

Nov 28, 2021

6.2.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Sep 01, 2021

6.1.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 31, 2021

6.0.1 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 21, 2021

6.0.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Aug 01, 2021

5.9.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 18, 2021

5.8.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 06, 2021

5.7.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 08, 2020

5.6.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 19, 2020

5.5.1 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Mar 19, 2020

5.5.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 26, 2020

5.4.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 25, 2020

5.3.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Feb 15, 2020

5.2.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 10, 2019

5.1.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 10, 2019

5.0.5 unknown yanked

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2019

5.0.4 unknown yanked

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2019

5.0.3 unknown yanked

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2019

5.0.2 unknown yanked

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2019

5.0.1 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 09, 2019

5.0.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jul 05, 2019

4.5.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jun 29, 2019

4.4.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

May 13, 2019

4.3.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Jan 09, 2019

4.2.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Dec 03, 2018

4.1.0 unknown

1 CVE

CVE-2021-45712 GHSA-cgw6-f3mj-h742 GHSA-xrg3-hmf3-rvgw RUSTSEC-2021-0126 Jun 17, 2022

RustEmbed generated `get` method allows for directory traversal when reading files from disk

Medium

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.

#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}

The flaw was corrected by canonicalizing the input filename and ensuring that it starts with the canonicalized folder path.

Fixed in


          6.3.0

References

Updated Nov 08, 2023 · Source: OSV.dev

Oct 24, 2018

Activity

Details