cnvd-2020-35526

EUVD-2026-36521

fkie_cve-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

GHSA-66q9-f7ff-mmx6 — Local file inclusion vulnerability in http4s

Affected: Maven: org.http4s:http4s-server_2.12

### Impact

This vulnerability applies to all users of: * `org.http4s.server.staticcontent.FileService` * `org.http4s.server.staticcontent.ResourceService` * `org.http4s.server.staticcontent.WebjarService`

#### Path escaping

URI normalization is applied incorrectly. Requests whose path info contain `../` or `//` can expose resources outside of the configured location. Specifically:

* `FileService` may expose any file on the local file system. * `ResourceService` may expose any resource on the class path.

#### Prefix matching

When the service is configured with a non-empty `pathPrefix` that doesn't end in a slash, any directories whose names are a prefix of `systemPath` (from `FileService`) or `pathPrefix` (from `ResourceService`) are exposed. For example, if `pathPrefix` is `/foo` and `systemPath` is `/bar`, a request to `/foobaz/quux.txt` exposes file `/barbaz/quux.txt`, when only files beneath `/bar` should be available.

#### URI decoding

URI segments are not decoded before resource resolution. This causes resources with reserved characters in their name to incorrectly return a 404. It also may incorrectly expose the rare resource whose name is URI encoded. This applies to `FileService`, `ResourceService`, and `WebjarService`.

### Patches

In all three services, paths with an empty segment, a `.` segment, or a `..` segment are now rejected with a `400 Bad Request` response. This fixes exposure outside the configured root. Many clients already eliminate dot…

Most recent entries from all

cnvd-2020-35526

EUVD-2026-36521

fkie_cve-2020-5280

GHSA-66q9-f7ff-mmx6 — Local file inclusion vulnerability in http4s

gsd-2020-5280