RUSTSEC-2026-0276: Path traversal in apimock's file-serving fallback

What to do

1. See which version you have: cargo tree -i apimock (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p apimock. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example apimock = "5.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The file-serving fallback joined a request-derived path onto the configured response directory and checked only that the result existed, never that it stayed inside that directory. A request containing a raw .. segment could read any file readable by the process, returned with HTTP 200.

Read-only: no write, no code execution.

On the 4.x line apimock is a single crate containing the serving code. Fixed in 4.8.1 by canonicalising each resolved path and rejecting anything outside its base directory.

**apimock 5.0.0 and later are not affected by this advisory.** From 5.0.0 the serving code moved to the apimock-server crate, which apimock depends on; that crate carries its own advisory for the same issue, fixed in 5.19.1.

References

• Package: crates.io/crates/apimock
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0276.html
• Web: github.com/apimokka/apimock-rs/commit/a9c05fec2d36a750c30e797291a0557f230c8faf

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.