DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69201: CVE-2026-69201: Path Traversal and Directory Escape in http4s Static Content Services

#security #cve #cybersecurity

CVE-2026-69201: Path Traversal and Directory Escape in http4s Static Content Services

Vulnerability ID: CVE-2026-69201
CVSS Score: 5.9
Published: 2026-09-15

CVE-2026-69201 is a critical directory traversal vulnerability in the http4s Scala library. Affected versions of ResourceService and WebjarService allow attackers to escape the configured resource directory and access arbitrary files on the classpath or filesystem by using percent-encoded path separators. The flaw arises from decoding URL segments prior to validating them against directory escape patterns.

TL;DR

Unauthenticated path traversal vulnerability in http4s static services allows reading arbitrary files outside the resource base directory via percent-encoded path separators.

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.9 (Medium)
  • Exploit Status: None (No active exploits observed)
  • CISA KEV Status: Not Listed
  • Impact: Confidentiality High (Unauthenticated Arbitrary File Read)

Affected Systems

  • http4s static content serving services (ResourceService, WebjarService, FileService)
  • http4s: < 0.23.35 (Fixed in: 0.23.35)
  • http4s: >= 1.0.0-M1, < 1.0.0-M47 (Fixed in: 1.0.0-M47)

Code Analysis

Commit: bcd99cd

Reject decoded segments containing slash or backslash in ResourceService and WebjarService, and apply the same guard to the non-exploitable FileService for consistency.

Mitigation Strategies

  • Upgrade http4s to version 0.23.35, 1.0.0-M47 or higher.
  • Configure upstream WAF / Reverse Proxy rules to sanitize or reject percent-encoded path separators.
  • Ensure Java runtime or host system avoids directory-backed classpaths if static files must be served from the application jar directly.

Remediation Steps:

  1. Identify any usage of ResourceService, WebjarService, or FileService in your Scala application.
  2. Update build.sbt or dependency files to pull http4s 0.23.35 or 1.0.0-M47.
  3. Perform regression testing of static resource delivery.
  4. Deploy and verify that requests containing %2F and %5C return HTTP 400 Bad Request.

References

Read the full report for CVE-2026-69201 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)