# CVE-2026-82481: OCaml cohttp directory traversal via URL decoding

Source: https://junglewise.ai/threats/cve-2026-82481-ocaml-cohttp-directory-traversal-via-url-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82481 · Severity: info · Published 2026-08-29

The cohttp HTTP library for OCaml contains a directory traversal vulnerability that allows attackers to access files outside intended directories. An attacker can craft malicious URLs with path traversal sequences to bypass access controls and potentially read sensitive files from the server.

Vendors: [OCaml](https://junglewise.ai/threats/vendors/ocaml).

## Quick answers

**Is CVE-2026-82481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82481 being exploited in the wild.

**How severe is CVE-2026-82481?** Informational severity, published 29 August 2026.

**Which products and versions are affected?** OCaml Cohttp before 6.3.0.

**Is there a fix for CVE-2026-82481?** A patch was published on 2026-08-20. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82481 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82481?** Check whether you run OCaml Cohttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The cohttp package before version 6.3.0 fails to properly URL-decode and validate path components before resolving file locations, enabling directory traversal attacks. The vulnerability exists in the HTTP request handling code that processes file serving requests. An attacker can exploit this by sending crafted HTTP requests with URL-encoded path traversal sequences (such as encoded dots and slashes) that are resolved after normalization, allowing escape from the intended serving directory. The fix, merged in PR #1145, involves URL-decoding path components before resolving them to prevent traversal sequences from being interpreted after path normalization. This issue affects any application using cohttp versions prior to 6.3.0 for serving static files.

## Affected products

- OCaml cohttp before 6.3.0

## Timeline

- 2026-08-29: disclosed
- 2026-08-20: patched

## References

- [https://github.com/mirage/ocaml-cohttp/pull/1145](https://github.com/mirage/ocaml-cohttp/pull/1145)