CVE-2026-69201: Http4s ResourceService and WebjarService path traversal via percent-encoded separators

CVE-2026-69201 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Http4s is a popular Scala web framework whose static file serving components (ResourceService and WebjarService) have a path traversal vulnerability. An attacker can bypass directory restrictions using percent-encoded path separators (%2F for forward slash, %5C for backslash on Windows) to read files outside the intended base directory. This allows disclosure of sensitive classpath resources that should not be publicly accessible.

Technologies: Http4s, org.http4s:http4s-server_2.12 (Maven), org.http4s:http4s-server_2.13 (Maven), org.http4s:http4s-server_3 (Maven). Vendors: Http4s, Maven.

Quick answers

Is CVE-2026-69201 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69201 being exploited in the wild.
How severe is CVE-2026-69201?
Medium severity, with a CVSS score of 5.9, published 15 September 2026.
Which products and versions are affected?
Http4s <= 0.23.34; org.http4s:http4s-server_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-server_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-server_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.
Is there a fix for CVE-2026-69201?
Yes. org.http4s:http4s-server_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-server_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-server_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69201 attacked?
It is attacked over the network.
Am I affected by CVE-2026-69201?
Check whether you run Http4s, org.http4s:http4s-server_2.12 (Maven), org.http4s:http4s-server_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.http4s:http4s-server_2.12 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-server_2.12 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-server_2.13 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-server_2.13 to 0.23.35 in your pom.xml or build.gradle
  • org.http4s:http4s-server_3 (Maven): upgrade to 0.23.35 or later
    # set org.http4s:http4s-server_3 to 0.23.35 in your pom.xml or build.gradle

Technical details

The vulnerability is a path traversal flaw (CWE-22) in Http4s's static file serving components. The affected code URL-decodes each path segment and rejects only exact matches of "", ".", or "..", but fails to detect path separators that have been percent-encoded (%2F for "/" or %5C for "\"). An attacker can craft a URL like `/base/path/%2F..%2F..%2Fsensitive/file` which decodes to `/base/path/../../../sensitive/file`, bypassing the validation and reading files outside the configured base. Exploitation requires: (1) the application uses ResourceService with a non-root base path or WebjarService, (2) classpath entries are served from filesystem directories (exploded .war or sbt run), and (3) the backend forwards the encoded characters without normalizing them. Patches in versions 0.23.35 and 1.0.0-M47 add validation to reject any decoded segment containing "/" or "\" with HTTP 400 Bad Request.

Affected products

  • http4s http4s-server_2.12 <= 0.23.34
  • http4s http4s-server_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
  • http4s http4s-server_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46

Identifiers

  • CVE-2026-69201
  • GHSA-crq5-92j2-j7wv

Timeline

  • 2026-09-15: disclosed: Vulnerability published via GitHub Advisory Database
  • 2026-09-15: patched: Patches released: http4s-server 0.23.35 and 1.0.0-M47

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.