MEDIUM

GHSA-mxc8-4jqf-368q

miniserve affected by a TOCTOU and symlink race vulnerability

Details

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/miniserve

Introduced in: 0Fixed in: 0.32.0

Upgrade miniserve to 0.32.0 or newer (ecosystem crates.io).

References

https://nvd.nist.gov/vuln/detail/CVE-2025-67124[ADVISORY]
https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f[WEB]
https://github.com/svenstaro/miniserve[PACKAGE]