CVE-2026-82481 in cohttp
Summary
by MITRE • 08/29/2026
The cohttp package before 6.3.0 for OCaml allows directory traversal.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/29/2026
The vulnerability identified in the cohttp library prior to version 6.3.0 represents a critical security flaw related to improper input validation and path normalization, specifically manifesting as a directory traversal or path canonicalization error. CoHTTP is a widely used HTTP client and server library for the OCaml programming language, serving as a foundational component for many web applications built within that ecosystem. The core technical issue stems from the library's handling of URL paths provided by clients during HTTP requests. When processing these paths, the implementation failed to adequately sanitize or normalize sequences such as double dots followed by forward slashes (../), which are standard indicators of directory traversal attempts in Unix-like file systems and web servers generally. This oversight allows an attacker to manipulate the requested resource path to escape the intended document root or application context, potentially accessing files located outside the designated public directories.
From a technical perspective, this flaw aligns directly with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability arises because the library does not strictly enforce that resolved file paths remain within an allowed boundary after resolving relative path components. In many web server configurations or application logic built on top of cohttp, developers assume that the underlying HTTP framework will safely handle path resolution. However, when this assumption is violated due to a lack of explicit sanitization in the library itself, it creates a gap where maliciously crafted URLs can bypass access controls. An attacker could construct a request with a URL containing encoded or unencoded traversal sequences to read sensitive configuration files, source code, environment variables stored on disk, or other private data that should not be exposed through the web interface.
The operational impact of this vulnerability is severe for any application relying on cohttp versions earlier than 6.3.0, particularly those serving static content or implementing file download features. Successful exploitation can lead to unauthorized information disclosure, which may result in the exposure of sensitive business data, user credentials stored in configuration files, or internal system architecture details that facilitate further attacks. In worst-case scenarios, if combined with other vulnerabilities such as arbitrary code execution through uploaded files, this traversal capability could contribute to a complete compromise of the host system. The severity is amplified by the fact that cohttp is often used in high-traffic environments where automated scanning tools frequently probe for directory traversal weaknesses, increasing the likelihood of exploitation attempts against unpatched systems.
Mitigation strategies primarily involve upgrading the cohttp package to version 6.3.0 or later, where this path normalization issue has been addressed through improved input validation and stricter enforcement of allowed directories. For applications that cannot immediately upgrade due to dependency constraints, developers should implement additional defensive coding practices at the application layer. This includes manually validating all incoming URL paths against a whitelist of permitted characters and ensuring that any resolved file system path is strictly contained within an expected base directory using canonicalization techniques before processing requests. Furthermore, web servers hosting these applications should be configured with strict access controls to limit what files are accessible regardless of how the request was routed through the application logic.
This vulnerability also relates to ATT&CK technique T1083: File and Directory Discovery, as it enables an adversary to enumerate and access restricted directories on a compromised system or web server. By exploiting this flaw, attackers can map out the file structure of the target environment, which is often a precursor to more destructive actions such as data exfiltration or lateral movement within a networked infrastructure. Security teams should prioritize patching this vulnerability in all production environments running affected versions of cohttp and conduct audits on any custom code that interacts with file systems via HTTP requests to ensure no similar logic flaws exist outside the library itself. Regular security testing, including static analysis and penetration testing focused on path traversal vectors, is recommended to maintain robust defense-in-depth against such input validation failures.