# CVE-2026-69201: Http4s ResourceService and WebjarService path traversal via percent-encoded separators

Source: https://junglewise.ai/threats/cve-2026-69201-http4s-resourceservice-and-webjarservice-path-traversal-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69201 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Http4s is a popular Scala web framework whose static file serving components (ResourceService and WebjarService) have a path traversal vulnerability. An attacker can bypass directory restrictions using percent-encoded path separators (%2F for forward slash, %5C for backslash on Windows) to read files outside the intended base directory. This allows disclosure of sensitive classpath resources that should not be publicly accessible.

Technologies: [Http4s](https://junglewise.ai/threats/technologies/http4s), [org.http4s:http4s-server_2.12 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-server-2-12), [org.http4s:http4s-server_2.13 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-server-2-13), [org.http4s:http4s-server_3 (Maven)](https://junglewise.ai/threats/technologies/org-http4s-http4s-server-3). Vendors: [Http4s](https://junglewise.ai/threats/vendors/http4s), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-69201 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69201 being exploited in the wild.

**How severe is CVE-2026-69201?** Medium severity, with a CVSS score of 5.9, published 15 September 2026.

**Which products and versions are affected?** Http4s <= 0.23.34; org.http4s:http4s-server_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-server_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35; org.http4s:http4s-server_3 (Maven) ECOSYSTEM:introduced=0,fixed=0.23.35.

**Is there a fix for CVE-2026-69201?** Yes. org.http4s:http4s-server_2.12 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-server_2.13 (Maven): upgrade to 0.23.35 or later; org.http4s:http4s-server_3 (Maven): upgrade to 0.23.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69201 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-69201?** Check whether you run Http4s, org.http4s:http4s-server_2.12 (Maven), org.http4s:http4s-server_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.http4s:http4s-server_2.12 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-server_2.12 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-server_2.13 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-server_2.13 to 0.23.35 in your pom.xml or build.gradle
  ```

- org.http4s:http4s-server_3 (Maven): upgrade to 0.23.35 or later

  ```sh
  # set org.http4s:http4s-server_3 to 0.23.35 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a path traversal flaw (CWE-22) in Http4s's static file serving components. The affected code URL-decodes each path segment and rejects only exact matches of "", ".", or "..", but fails to detect path separators that have been percent-encoded (%2F for "/" or %5C for "\"). An attacker can craft a URL like `/base/path/%2F..%2F..%2Fsensitive/file` which decodes to `/base/path/../../../sensitive/file`, bypassing the validation and reading files outside the configured base. Exploitation requires: (1) the application uses ResourceService with a non-root base path or WebjarService, (2) classpath entries are served from filesystem directories (exploded .war or sbt run), and (3) the backend forwards the encoded characters without normalizing them. Patches in versions 0.23.35 and 1.0.0-M47 add validation to reject any decoded segment containing "/" or "\" with HTTP 400 Bad Request.

## Affected products

- http4s http4s-server_2.12 <= 0.23.34
- http4s http4s-server_2.13 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46
- http4s http4s-server_3 <= 0.23.34, >= 1.0.0-M1 to <= 1.0.0-M46

## Identifiers

- CVE-2026-69201
- GHSA-crq5-92j2-j7wv

## Timeline

- 2026-09-15: disclosed: Vulnerability published via GitHub Advisory Database
- 2026-09-15: patched: Patches released: http4s-server 0.23.35 and 1.0.0-M47

## References

- [https://api.github.com/users/Lasering](https://api.github.com/users/Lasering)
- [https://github.com/Lasering](https://github.com/Lasering)
- [https://api.github.com/users/Lasering/gists%7B/gist_id%7D](https://api.github.com/users/Lasering/gists%7B/gist_id%7D)
- [https://api.github.com/users/Lasering/repos](https://api.github.com/users/Lasering/repos)
- [https://avatars.githubusercontent.com/u/5956311?v=4](https://avatars.githubusercontent.com/u/5956311?v=4)
- [https://api.github.com/users/Lasering/events%7B/privacy%7D](https://api.github.com/users/Lasering/events%7B/privacy%7D)

## Related threats

- [Http4s Ember HTTP/1.1 parser request smuggling via duplicate Content-Length](https://junglewise.ai/threats/cve-2026-69217-http4s-ember-http-1-1-parser-request-smuggling-via-duplicate)
- [Http4s WebSocket decoder negative length handling denial of service](https://junglewise.ai/threats/cve-2026-69210-http4s-websocket-decoder-negative-length-handling-denial-of)
- [Http4s DigestAuth replay attack in authorization header](https://junglewise.ai/threats/cve-2026-69206-http4s-digestauth-replay-attack-in-authorization-header)
- [Http4s FollowRedirect credential leak on scheme downgrade](https://junglewise.ai/threats/cve-2026-69212-http4s-followredirect-credential-leak-on-scheme-downgrade)
- [Http4s ResponseCookie header injection via unescaped attributes](https://junglewise.ai/threats/cve-2026-69211-http4s-responsecookie-header-injection-via-unescaped-attributes)