https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:02:55.463998+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-35526 cnvd-2020-35526 2026-10-03T16:02:55.547396+00:00 cnvd-2020-35526 https://cve.radiocsirt.org/vuln/euvd-2026-36521 EUVD-2026-36521 2026-10-03T16:02:55.547437+00:00 EUVD-2026-36521 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5280 fkie_cve-2020-5280 2026-10-03T16:02:55.547452+00:00

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

 https://cve.radiocsirt.org/vuln/ghsa-66q9-f7ff-mmx6 GHSA-66q9-f7ff-mmx6 — Local file inclusion vulnerability in http4s 2026-10-03T16:02:55.547485+00:00

Affected: Maven: org.http4s:http4s-server_2.12

### Impact

This vulnerability applies to all users of: * `org.http4s.server.staticcontent.FileService` * `org.http4s.server.staticcontent.ResourceService` * `org.http4s.server.staticcontent.WebjarService`

#### Path escaping

URI normalization is applied incorrectly. Requests whose path info contain `../` or `//` can expose resources outside of the configured location. Specifically:

* `FileService` may expose any file on the local file system. * `ResourceService` may expose any resource on the class path.

#### Prefix matching

When the service is configured with a non-empty `pathPrefix` that doesn't end in a slash, any directories whose names are a prefix of `systemPath` (from `FileService`) or `pathPrefix` (from `ResourceService`) are exposed. For example, if `pathPrefix` is `/foo` and `systemPath` is `/bar`, a request to `/foobaz/quux.txt` exposes file `/barbaz/quux.txt`, when only files beneath `/bar` should be available.

#### URI decoding

URI segments are not decoded before resource resolution. This causes resources with reserved characters in their name to incorrectly return a 404. It also may incorrectly expose the rare resource whose name is URI encoded. This applies to `FileService`, `ResourceService`, and `WebjarService`.

### Patches

In all three services, paths with an empty segment, a `.` segment, or a `..` segment are now rejected with a `400 Bad Request` response. This fixes exposure outside the configured root. Many clients already eliminate dot…

 https://cve.radiocsirt.org/vuln/gsd-2020-5280 gsd-2020-5280 2026-10-03T16:02:55.547539+00:00 gsd-2020-5280