Skip to content
Fencer Vulns
no cvss —

OSEC-2026-16 json

Path traversal in Cohttp.Path.resolve_local_file

published 2026-08-20 2 mo ago modified 2026-11-06 2 d ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The issue is that the function normalizes the URI path before percent decoding it:

```OCaml let resolve_local_file ~docroot ~uri =

let path = Uri.(pct_decode (path (resolve "http" (of_string "/") uri))) in

... ```

Because `%2f` is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For example, a request path like:

``` /static/..%2f..%2f..%2fetc/passwd ```

is normalized as a single encoded segment, then decoded into:

``` /static/../../../etc/passwd ```

afterwards.

## Timeline

- Aug 11th 2026: report to security@ocaml.org - Aug 14th 2026: PR published on <https://github.com/mirage/ocaml-cohttp/pull/1145> - Aug 20th 2026: fix released in v6.3.0 <https://github.com/ocaml/opam-repository/pull/30528>

Patch / fix

  • opam cohttp 6.3.0

Affected packages

ecosystem package affected fixed in
opam cohttp
<6.3.0
6.3.0

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.