crates.io/static-web-server CVE-2025-67487: medium, EPSS 0.42%

Static Web Server vulnerable to a symbolic link path traversal

Action: Upgrade static-web-server to 2.40.1 or later.

cargo update -p static-web-server --precise 2.40.1

Affected

Fixed versions

Sources

• osv: GHSA-459f-x8vq-xjjm
• https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm
• https://nvd.nist.gov/vuln/detail/CVE-2025-67487
• https://github.com/static-web-server/static-web-server/commit/308f0d26ceb9c2c8bd219315d0f53914763357f2
• https://github.com/static-web-server/static-web-server

CVE-2025-67487 · published 2025-12-08T22:18:00Z · modified 2025-12-09T19:36:56.381097Z · JSON