Zephyr RTOS CVE-2026-8023

Exploitation requires that the target firmware was built with CONFIG_FILE_SYSTEM enabled AND registers a static-filesystem HTTP resource (HTTP_RESOURCE_TYPE_STATIC_FS) reachable via wildcard/leading-directory or fallback resource matching, with the Zephyr HTTP server network-reachable by the attacker. Given those conditions, no authentication, TLS, or user interaction is needed (AV:N/AC:L/PR:N/UI:N) - an unauthenticated remote client simply sends a path containing ../ traversal sequences. The exploitation is limited by deployment specifics: devices without the static-FS resource, without a filesystem, or with the HTTP server isolated from attacker-reachable networks are not exploitable, and disclosure is bounded to files readable on the mounted volume.

Signals are largely consistent and point to a genuine, easy-to-exploit information-disclosure issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) reflects unauthenticated network exploitation with low complexity and high confidentiality impact but no integrity or availability effect - appropriate for an arbitrary-read traversal. This is not in CISA KEV, and no POC has been published, so exploitation status is 'no public exploit identified at time of analysis'; the lack of an EPSS score in the input means probabilistic exploitation likelihood is unknown. The most important limiting factor is exposure: the vulnerable code path only exists when CONFIG_FILE_SYSTEM is enabled AND the application registers a static-filesystem HTTP resource, and the device's HTTP server must be network-reachable - so real-world impact depends heavily on deployment, which materially narrows the affected population below what the 7.5 score alone suggests. Where those conditions are met, however, exploitation is trivial and unauthenticated, making prompt patching warranted. No conflicting signals were observed; the chief gap is the absence of EPSS/KEV data to gauge in-the-wild interest.

An attacker who can reach a Zephyr-based device's HTTP server (no TLS or authentication required) sends a crafted request such as GET /static/../../etc/secret against a registered static-FS resource. The HTTP server concatenates the raw path to the web root and the underlying filesystem resolves the .. segments, returning the contents of arbitrary readable files such as configuration, keys, or credentials. No POC is publicly available, but the low attack complexity makes the request straightforward to construct by hand.