Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public. On Windows, a similar attack exists with (%5C). Impact Disclosure of classpath or webjar resources outside the configured base. Preconditions - Application uses ResourceService (with a non-root base path) or WebjarService - At least one classpath entry is served from a directory (e.g. sbt run, exploded .war) - Backend forwards %2F/%5C without normalizing (e.g., Ember, Blaze) Fixes The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService. FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization. Workarounds - Deploy as a…
Recommended action: Upgrade to 0.23.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This vulnerability applies to all users of: org.http4s.server.staticcontent.FileService org.http4s.server.staticcontent.ResourceService org.http4s.server.staticcontent.WebjarService Path escaping URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. Specifically: FileService may expose any file on the local file system. ResourceService may expose any resource on the class path. Prefix matching When the service is configured with a non-empty pathPrefix that doesn't end in a slash, any directories whose names are a prefix of systemPath (from FileService) or pathPrefix (from ResourceService) are exposed. For example, if pathPrefix is /foo and systemPath is /bar, a request to /foobaz/quux.txt exposes file /barbaz/quux.txt, when only files beneath /bar should be available. URI decoding URI segments are not decoded before resource resolution. This causes resources with reserved characters in…
Recommended action: Upgrade to 0.21.2, 0.20.20 or 0.18.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.