What is the CVSS score of CVE-2026-69201?

CVE-2026-69201 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2026-69201?

Yes, a public proof-of-concept exploit is available for CVE-2026-69201. Prioritise patching immediately. EPSS: 0.6%.

Is there a patch available for CVE-2026-69201?

Yes, a patch is available for CVE-2026-69201. Update the affected software to the latest version immediately.

Http4s CVE-2026-69201

EUVD-2026-79177 MEDIUM

Path Traversal (CWE-22)

2026-09-15 security-advisories@github.com

GHSA-crq5-92j2-j7wv

Path Traversal

5.9

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 15, 2026 - 20:19 EUVD

Source Code Evidence Fetched

Sep 15, 2026 - 19:31 vuln.today

Analysis Generated

Sep 15, 2026 - 19:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.http4s:http4s-server_2.12 (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.23.35.

DescriptionCVE.org

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only segments exactly equal to an empty string, a dot, or two dots. A request containing percent-encoded slash or backslash separators can turn an accepted segment into a parent-directory traversal after decoding, allowing access to classpath or WebJar resources outside the configured base when a directory-backed classpath is served and the backend preserves the encoded separator. The patch rejects decoded segments containing slash or backslash in ResourceService and WebjarService, and applies the same guard to the non-exploitable FileService for consistency. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

AnalysisAI

Path traversal in http4s static-content services (ResourceService and WebjarService) before 0.23.35 and 1.0.0-M47 lets remote unauthenticated attackers read classpath or WebJar resources outside the configured base directory by hiding parent-directory sequences behind percent-encoded separators (%2F or %5C). The flaw only bites when the service is mounted on a directory-backed classpath and the underlying backend preserves the encoded separator through to path resolution, which is why NVD scores the attack complexity as High; impact is limited to information disclosure (confidentiality only), with no write or availability effect. …