EUVD-2026-68116
GHSA-qcjm-vmrx-v935
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:X
Network vector, no auth, no interaction; pure read-only traversal gives high confidentiality but no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
The cohttp package before 6.3.0 for OCaml allows directory traversal.
AnalysisAI
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as ..%2f..%2f in HTTP request URIs. The root cause (CWE-180) is that Cohttp.Path.resolve_local_file validated and stripped . …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target server is built with the cohttp OCaml library (any version before 6.3.0) and uses `Cohttp.Path.resolve_local_file` to map request URIs to local files for serving. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N reflects a high-confidence assessment: network-reachable, no authentication, no user interaction, and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade cohttp to version 6.3.0 or later via opam (`opam update && opam upgrade cohttp cohttp-mirage`); v6.3.0 was released 2026-08-19 and is confirmed in the upstream CHANGES.md (https://github.com/mirage/ocaml-cohttp/pull/1145). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, catalog all systems and applications using the cohttp HTTP library and document which versions are currently deployed in production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today