What is the CVSS score of CVE-2026-8023?

CVE-2026-8023 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.7%.

Which versions of Zephyr RTOS are affected by CVE-2026-8023?

Zephyr RTOS-based embedded systems and IoT devices (versions 4.0.0-4.4.0) are exposed to unauthenticated remote file-access attacks that could leak credentials, configurations, proprietary…. A patch is available.

How to fix or mitigate CVE-2026-8023?

24 hours: Identify all deployed instances of Zephyr RTOS versions 4.0.0-4.4.0 with HTTP server functionality and CONFIG_FILE_SYSTEM enabled; assess network exposure and test patch compatibility in isolated non-production environment. 7 days: Deploy vendor-released patch to all production Zephyr systems; verify HTTP server file-access restrictions are enforced and devices reject path-traversal requests. 30 days: Analyze security logs for evidence of path-traversal exploitation attempts; confirm all Zephyr instances across all environments updated to patched version; document remediation evidence for compliance records.

Zephyr RTOS CVE-2026-8023

HIGH

Path Traversal (CWE-22)

2026-06-29 zephyr

Path Traversal Information Disclosure Zephyr

7.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote request with low complexity reads arbitrary files (PR:N, AC:L, C:H); no integrity or availability impact and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:50 vuln.today

DescriptionCVE.org

Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that serves files from a configured root directory. Before this fix, both the HTTP/1 and HTTP/2 front-ends placed the raw, attacker-controlled request path into client-url_buffer (assembled in on_url() for HTTP/1 and copied verbatim from the :path pseudo-header for HTTP/2) without resolving ./.. segments. The static-FS handler then built the on-disk filename by directly concatenating the configured root with that raw URL (snprintk(fname, ..., "%s%s", static_fs_detail-fs_path, client-url_buffer) at http_server_http1.c:603 and http_server_http2.c:490) and opened it with fs_open(fname, FS_O_READ). Because the handler is reached via wildcard/leading-dir (fnmatch FNM_LEADING_DIR) or fallback resource matching, a request such as GET /<prefix/../../<file is dispatched to the handler and, after the underlying filesystem (e.g. LittleFS/FAT) resolves the .. segments, escapes the configured web root, letting an unauthenticated remote client read arbitrary readable files on the mounted volume (information disclosure). The HTTP server requires no TLS or authentication to reach this path. The fix adds http_server_remove_dot_segments(), which canonicalizes the path portion of the URL before resource lookup in both protocol handlers, neutralizing the traversal. Affects releases v4.0.0 through v4.4.0 for deployments that register a static-filesystem resource.

AnalysisAI

Arbitrary file read in the Zephyr RTOS HTTP server (subsys/net/lib/http) lets an unauthenticated remote client retrieve any readable file on the mounted filesystem volume by abusing path-traversal sequences against a registered static-filesystem resource. Affecting Zephyr v4.0.0 through v4.4.0 with CONFIG_FILE_SYSTEM enabled and a static-FS resource registered, the flaw stems from the raw request path being concatenated to the web root without canonicalization in both the HTTP/1 and HTTP/2 front-ends. No public exploit identified at time of analysis, but the bug is trivial to trigger (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) and a vendor patch is available.

Technical ContextAI

Zephyr is a widely-used real-time operating system for resource-constrained embedded and IoT devices. The affected component is its native HTTP server library, which supports an HTTP_RESOURCE_TYPE_STATIC_FS resource type (compiled in when CONFIG_FILE_SYSTEM is enabled) that serves files from a configured root directory backed by a filesystem such as LittleFS or FAT. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): both protocol front-ends place the attacker-controlled request path into client->url_buffer - assembled in on_url() for HTTP/1 and copied verbatim from the :path pseudo-header for HTTP/2 - without resolving ./.. segments. The static-FS handler then builds the on-disk filename via snprintk(fname, ..., "%s%s", static_fs_detail->fs_path, client->url_buffer) (http_server_http1.c:603 and http_server_http2.c:490) and calls fs_open(fname, FS_O_READ). Because the handler is reached through wildcard/leading-directory matching (fnmatch with FNM_LEADING_DIR) or fallback resource matching, traversal payloads are dispatched to it, and the underlying filesystem resolves the .. segments, escaping the web root. The CPE cpe:2.3:a:zephyrproject:zephyr identifies the affected project. The fix introduces http_server_remove_dot_segments() to canonicalize the URL path before resource lookup in both handlers.

RemediationAI

Apply the vendor patch: upgrade to the fixed Zephyr release that includes commit f4a423c98554f209c5d2f22f041822422c9263b8, which adds http_server_remove_dot_segments() to canonicalize URL paths in both the HTTP/1 and HTTP/2 handlers (Patch available per vendor advisory; consult GHSA-hch3-53g6-jj3h for the exact released version, as the input provides the fix commit rather than a tagged release number - released patched version not independently confirmed). If immediate upgrade is not feasible, compensating controls include: disabling or unregistering the static-filesystem HTTP resource (HTTP_RESOURCE_TYPE_STATIC_FS) if file serving is not essential, which removes the vulnerable path entirely but disables static file hosting; restricting network reachability of the HTTP server to trusted management networks via firewall/ACLs, which limits remote access but does not stop authorized-segment attackers; and minimizing what is mounted on the served volume so that traversal cannot reach sensitive files, accepting that any readable file on the volume otherwise remains exposed. Advisory references: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hch3-53g6-jj3h and the patch commit https://github.com/zephyrproject-rtos/zephyr/commit/f4a423c98554f209c5d2f22f041822422c9263b8.