Executive brief
A vulnerability in the Zephyr real-time operating system's HTTP server allows unauthorized users to access sensitive files stored on a device. By sending a specially crafted web request, an attacker can bypass security restrictions and read files outside of the intended public folder, such as WiFi passwords, security tokens, or private keys. This issue affects devices using Zephyr's static file-serving feature and could lead to a full compromise of device credentials and user data.
Technical details
A path traversal vulnerability exists in Zephyr's HTTP server (subsys/net/lib/http) when the static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS) is used with wildcard or leading-directory matching. Both HTTP/1.1 and HTTP/2 protocol handlers fail to resolve or sanitize dot segments (./..) in the request path before concatenating it with the configured root directory. An unauthenticated remote attacker can exploit this by sending a GET request containing traversal sequences to escape the web root and access any readable file on the mounted volume. The fix introduces path canonicalization via http_server_remove_dot_segments() to neutralize the traversal before resource lookup.
Affected products
- Zephyr Project Zephyr OS v4.0.0 through v4.4.0
Timeline
- 2024-07-31: other: Vulnerability introduced in commit e55278a87be4e5534ba772b23e459882866bcd6d
- 2026-06-26: other: Embargo date
- 2026-06-29: disclosed
- 2026-06-29: advisory