---
id: 9c2726a2-8e2b-47cf-9a09-94b13aa491e4
title: serve 404.html symlink escapes www and leaks host files
state: closed
labels:
- kind:security
assignees: []
milestone: null
created: 2026-10-27T18:40:16.931258254Z
updated: 2026-10-27T19:53:10.508711324Z
---
## Problem

`serve`'s normal static path resolves symlinks and rejects targets outside `www`, but the custom 404 fallback reads `www/404.html` with a raw `metadata`/`File::open` and no symlink or prefix check. A symlinked `404.html` can publish any host file on every unknown path.

Verified:

```
ln -s /etc/hostname /tmp/rev5-404www/404.html
hu13 serve --www /tmp/rev5-404www --inbox-dir /tmp/rev5-inbox --listen 127.0.0.1:39441
curl http://127.0.0.1:39441/nope
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
reflectivity
```

If the symlink target is script-bearing HTML, it also executes in the inbox origin because the 404 response has no attachment disposition. `src/serve.rs:913-931`.

## Fix

Resolve `404.html` with the same `resolve_existing`/`starts_with(www)` check as normal static paths and reject symlinks (or require the resolved target under `www`). Add a symlinked-404 integration test.