CVE-2026-69201 in Http4s
Summary
by MITRE • 09/15/2026
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base when a directory-backed classpath is served and the backend preserves the encoded separator. The patch rejects decoded segments containing slash or backslash in ResourceService and WebjarService, and applies the same guard to the non-exploitable FileService for consistency. This issue is fixed in versions 0.23.35 and 1.0.0-M47.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Http4s represents a critical path traversal flaw within its resource serving mechanisms, specifically affecting the ResourceService and WebjarService components prior to version 0.23.35 and 1.0.0-M47. Http4s serves as a functional HTTP library for Scala, widely used by developers building high-performance web services. The core of this vulnerability lies in how these services parse and validate URL path segments during request processing. When an incoming HTTP request targets resources served from the classpath or WebJar archives, the service decodes each segment of the requested URI to determine file system paths or internal resource locations. However, the validation logic implemented in earlier versions was insufficiently robust against encoded evasion techniques.
The technical flaw stems from a discrepancy between URL encoding and path normalization. The original implementation rejected only those segments that were exactly equal to an empty string, a single dot representing the current directory, or two dots representing the parent directory when interpreted as plain text strings. It failed to account for percent-encoded characters that represent path separators after decoding. Specifically, if an attacker submits a URL containing percent-encoded forward slashes (%2F) or backslashes (%5C), these encoded sequences are treated as valid alphanumeric segments by the initial validation check because they do not literally match dot patterns. However, once the URI is decoded to resolve the actual resource location, these separators become active path delimiters. This allows an attacker to construct a payload that bypasses the directory boundary checks and effectively performs a parent-directory traversal attack.
This behavior enables unauthorized access to sensitive files located outside the intended base directory of the served resources. In scenarios where Http4s is configured to serve static assets from a classpath or WebJar, this flaw can lead to information disclosure. An attacker could potentially read configuration files, source code, private keys, or other confidential data stored in directories above the web root by manipulating the URL path with encoded separators. The severity of this issue depends on the specific deployment context and whether sensitive resources are accessible via the classpath mechanism, but it fundamentally breaks the isolation guarantees expected from a secure static file serving service.
The vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. From an offensive security perspective, this technique is categorized under ATT&CK T1083: File and Directory Discovery, specifically involving the use of encoded characters to bypass access controls. The exploitation relies on the backend preserving the decoded separator while the application logic only validated the pre-decoded string structure, a classic example of inconsistent interpretation between layers in web applications.
To mitigate this vulnerability, users must upgrade Http4s to version 0.23.35 or later for the 0.23.x branch, or version 1.0.0-M47 and later for the main development line. The patch addresses the issue by enforcing stricter validation rules that reject any decoded segment containing slash or backslash characters, not just those matching specific dot patterns. This ensures that path separators are identified regardless of whether they appear in their raw form or as percent-encoded sequences. Additionally, developers should ensure that all resource serving endpoints utilize these updated services to maintain consistency and prevent similar bypasses through other service implementations like FileService, which was also hardened for defense-in-depth purposes even if it was not directly exploitable in the same manner.