cohttp OCaml CVE-2026-82481

Exploitation requires that the target server is built with the cohttp OCaml library (any version before 6.3.0) and uses Cohttp.Path.resolve_local_file to map request URIs to local files for serving. Servers that do not invoke this function - for example, those that use cohttp only as an HTTP client or that handle routing entirely in application logic without local file resolution - are not affected. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and no special client-side conditions apply. Exploitation is limited to confidentiality (file reads); the CVSS vector records no integrity or availability impact, consistent with a read-only traversal primitive. Filesystem permissions apply: files readable only by root or a privileged user will resist exfiltration if the server process runs under a restricted account.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N reflects a high-confidence assessment: network-reachable, no authentication, no user interaction, and high confidentiality impact. These signals are consistent with the technical description - any HTTP server using resolve_local_file is exposed with no prerequisites beyond network access. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified; however, the attack primitive (percent-encoded path traversal) is well-understood and trivially scriptable, making low EPSS unlikely if the library sees meaningful deployment. No KEV listing exists, and no public POC has been identified, suggesting exploitation is not yet observed at scale. The primary risk limiter is prevalence: cohttp is confined to the OCaml/MirageOS ecosystem, which is a niche deployment footprint compared to mainstream HTTP stacks. Servers not using resolve_local_file (e.g., those that handle file serving through other means) are not affected.

An unauthenticated attacker sends an HTTP GET request to a cohttp-based static file server with a URI containing percent-encoded traversal sequences, for example GET /..%2f..%2f..%2fetc%2fpasswd HTTP/1.1. Because the library strips .. segments before decoding, the encoded form survives sanitization and is resolved against the docroot after decoding, returning the contents of /etc/passwd or any other readable file on the filesystem. No exploit code has been publicly identified, but the technique is elementary and well-documented for this class of flaw.