Is CVE-2026-8023 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8023 being exploited in the wild.

How severe is CVE-2026-8023?

High severity, with a CVSS score of 7.5, published 29 June 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS v4.0.0 through v4.4.0.

Is there a fix for CVE-2026-8023?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8023 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-8023?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8023: Zephyr RTOS path traversal in HTTP server static-filesystem handler

CVE-2026-8023 · Severity: high · CVSS 7.5 · Published 2026-06-29

A vulnerability in the Zephyr real-time operating system's HTTP server allows unauthorized users to access sensitive files stored on a device. By sending a specially crafted web request, an attacker can bypass security restrictions and read files outside of the intended public folder, such as WiFi passwords, security tokens, or private keys. This issue affects devices using Zephyr's static file-serving feature and could lead to a full compromise of device credentials and user data.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-8023 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8023 being exploited in the wild.
How severe is CVE-2026-8023?: High severity, with a CVSS score of 7.5, published 29 June 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS v4.0.0 through v4.4.0.
Is there a fix for CVE-2026-8023?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8023 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-8023?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in Zephyr's HTTP server (subsys/net/lib/http) when the static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS) is used with wildcard or leading-directory matching. Both HTTP/1.1 and HTTP/2 protocol handlers fail to resolve or sanitize dot segments (./..) in the request path before concatenating it with the configured root directory. An unauthenticated remote attacker can exploit this by sending a GET request containing traversal sequences to escape the web root and access any readable file on the mounted volume. The fix introduces path canonicalization via http_server_remove_dot_segments() to neutralize the traversal before resource lookup.

Affected products

Zephyr Project Zephyr OS v4.0.0 through v4.4.0

Timeline

2024-07-31: other: Vulnerability introduced in commit e55278a87be4e5534ba772b23e459882866bcd6d
2026-06-26: other: Embargo date
2026-06-29: disclosed
2026-06-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.