{"id":"CVE-2026-69201","aliases":["GHSA-crq5-92j2-j7wv"],"url":"https://o3.security/vulnerability/CVE-2026-69201","summary":"Http4s: ResourceService and Webjar Service path escape via percent-encoded separators","details":"The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segments that are exactly `\"\"`, `\".\"`, or `\"..\"`.  A percent-encoded separator (`%2F`) lets an attacker smuggle a `../` segment past that filter and escape the configured base, reading resources that should not be public.\n\nOn Windows, a similar attack exists with (`%5C`).\n\n## Impact\n\nDisclosure of classpath or webjar resources outside the configured base.\n\n## Preconditions\n\n- Application uses `ResourceService` (with a non-root base path) or `WebjarService`\n- At least one classpath entry is served from a directory (e.g. `sbt run`, exploded .war)\n- Backend forwards `%2F`/`%5C` without normalizing (e.g., Ember, Blaze)\n\n## Fixes\n\nThe patch rejects any decoded path segment containing `/` (`%2F`) or `\\` (`%5C`) with a `400 Bad Request` in `ResourceService` and `WebjarService`.\n\n`FileService` was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization.\n\n## Workarounds\n\n- Deploy as a fat jar, with no filesystem directories on the classpath.\n- Front the service with a proxy that rejects/normalizes `%2F` and `%5C` in the request path.","published":"2026-09-15T19:02:18.376Z","modified":"2026-10-28T02:30:53.949800132Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":{"score":0.00627,"percentile":0.48476,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.http4s:http4s-server_2.12","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-server_2.13","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-server_3","fixedVersion":"0.23.35"},{"ecosystem":"Maven","name":"org.http4s:http4s-server_3","fixedVersion":"1.0.0-M47"},{"ecosystem":"Maven","name":"org.http4s:http4s-server_2.13","fixedVersion":"1.0.0-M47"}],"fix":{"url":"https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3","label":"http4s/http4s@bcd99cd"},"references":[{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v0.23.35"},{"type":"WEB","url":"https://github.com/http4s/http4s/releases/tag/v1.0.0-M47"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69201.json"},{"type":"ADVISORY","url":"https://github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69201"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3"},{"type":"PACKAGE","url":"https://github.com/http4s/http4s"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.949800132Z"}}