GHSA-mxc8-4jqf-368q

miniserve affected by a TOCTOU and symlink race vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-67124

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	miniserve	< 0.32.0	0.32.0

Details

As written in the advisory (Markdown source, shown as plain text).

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-67124 advisory
https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f web
https://github.com/svenstaro/miniserve package