---

id: fb59a187-80c0-4c80-a6f9-3de604f9843d title: inbox-dir symlink into www exposes private submissions state: closed labels:

• kind:security assignees: [] milestone: null created: 2026-10-27T18:08:32.906968950Z updated: 2026-10-27T18:20:51.846193895Z

---

What

ensure_inbox_outside_www() only compares lexical paths; serve static file lookup follows symlinks inside www.

src/serve.rs:175-186.

Reproduced

mkdir -p /tmp/www/private
ln -s /tmp/www/private /tmp/inbox-link
hu13 serve --www /tmp/www --inbox-dir /tmp/inbox-link --listen 127.0.0.1:39332
curl http://127.0.0.1:39332/private/leak.json

Startup succeeds (the inbox path is lexically outside /tmp/www), and the file is served with 200. Actual inbox submissions written through the symlink land inside the served tree.

Impact

Violates the explicit “inbox must never be served” invariant; private submissions can be exposed.

Fix

• Canonicalize/resolve the existing ancestors of both www and inbox-dir before comparison (the build resolve_existing helper is a model).
• Consider refusing symlinked components under www for static serving.
• Tests: inbox path symlinked into www, inbox parent symlinked into www, and www itself a symlink.