Medium, CVSS 5.9MavenAmendedPublished
Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
CVE-2026-69201 · GHSA-crq5-92j2-j7wv
- Affected
- Maven org.http4s:http4s-server_3 <= 0.23.34; >= 1.0.0-M1, <= 1.0.0-M46
- Fixed in
- 0.23.351.0.0-M47· Vendor fix available
- Issue
- The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public. On Windows, a similar attack exists with (%5C). Impact Disclosure of classpath or webjar resources outside the configured base. Preconditions - Application uses ResourceService (with a non-root base path) or WebjarService - At least one classpath entry is served from a directory (e.g. sbt run, exploded .war) - Backend forwards %2F/%5C without normalizing (e.g., Ember, Blaze) Fixes The patch rejects any decoded path segment containing / (%2F) or \ (%5C) with a 400 Bad Request in ResourceService and WebjarService. FileService was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization. Workarounds - Deploy as a…
Recommended action: Upgrade to 1.0.0-M47 (pre-release) or 0.23.35 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.