Executive brief
Http4s is a popular Scala web framework whose static file serving components (ResourceService and WebjarService) have a path traversal vulnerability. An attacker can bypass directory restrictions using percent-encoded path separators (%2F for forward slash, %5C for backslash on Windows) to read files outside the intended base directory. This allows disclosure of sensitive classpath resources that should not be publicly accessible.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in Http4s's static file serving components. The affected code URL-decodes each path segment and rejects only exact matches of "", ".", or "..", but fails to detect path separators that have been percent-encoded (%2F for "/" or %5C for "\"). An attacker can craft a URL like `/base/path/%2F..%2F..%2Fsensitive/file` which decodes to `/base/path/../../../sensitive/file`, bypassing the validation and reading files outside the configured base. Exploitation requires: (1) the application uses ResourceService with a non-root base path or WebjarService, (2) classpath entries are served from filesystem directories (exploded .war or sbt run), and (3) the backend forwards the encoded characters without normalizing them. Patches in versions 0.23.35 and 1.0.0-M47 add validation to reject any decoded segment containing "/" or "\" with HTTP 400 Bad Request.
Affected products
- http4s http4s-server_2.12 <= 0.23.34
- http4s http4s-server_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-server_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
Timeline
- 2026-09-15: disclosed: Vulnerability published via GitHub Advisory Database
- 2026-09-15: patched: Patches released: http4s-server 0.23.35 and 1.0.0-M47