Executive brief
The cohttp HTTP library for OCaml contains a directory traversal vulnerability that allows attackers to access files outside intended directories. An attacker can craft malicious URLs with path traversal sequences to bypass access controls and potentially read sensitive files from the server.
Technical details
The cohttp package before version 6.3.0 fails to properly URL-decode and validate path components before resolving file locations, enabling directory traversal attacks. The vulnerability exists in the HTTP request handling code that processes file serving requests. An attacker can exploit this by sending crafted HTTP requests with URL-encoded path traversal sequences (such as encoded dots and slashes) that are resolved after normalization, allowing escape from the intended serving directory. The fix, merged in PR #1145, involves URL-decoding path components before resolving them to prevent traversal sequences from being interpreted after path normalization. This issue affects any application using cohttp versions prior to 6.3.0 for serving static files.
Affected products
- OCaml cohttp before 6.3.0
Timeline
- 2026-08-29: disclosed
- 2026-08-20: patched