Cohttp
Monthly
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.