CVE-2026-69201: Http4s Path Traversal Vulnerability

CVE-2026-69201 Overview

CVE-2026-69201 is a path traversal vulnerability in Http4s, a Scala interface for HTTP services. The flaw affects the ResourceService and WebjarService static content handlers in versions prior to 0.23.35 and 1.0.0-M47. These services decode each URL path segment but reject only segments exactly equal to "", ".", or "..". Attackers can submit percent-encoded slash (%2F) or backslash (%5C) characters within a segment to reintroduce path separators after decoding. This transforms an accepted segment into a parent-directory traversal, exposing classpath or WebJar resources outside the configured base directory.

Critical Impact
Remote attackers can read arbitrary classpath or WebJar resources when a directory-backed classpath is served and the HTTP backend preserves encoded separators, exposing confidential application files.

Affected Products

Http4s ResourceService in versions prior to 0.23.35
Http4s WebjarService in versions prior to 0.23.35
Http4s 1.0.0-M1 through 1.0.0-M46 milestone releases

Discovery Timeline

2026-09-15 - CVE-2026-69201 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-69201

Vulnerability Analysis

The vulnerability is a classic path traversal weakness [CWE-22] rooted in incomplete segment validation. Http4s splits the request URI into segments and URL-decodes each one before resolving it against the configured root path. The pre-patch validation logic rejects a segment only when it equals the empty string, a single dot, or a double dot after decoding. It does not inspect the decoded value for embedded separator characters. As a result, a segment such as %2E%2E%2Fetc decodes to ../etc, which then resolves outside the intended base directory when passed to path.resolve(segment).

Exploitation requires that the underlying HTTP backend preserve the percent-encoded separators in the raw path rather than normalize them before routing. When that condition holds, attackers can escape the configured root of a ResourceService or WebjarService handler and retrieve files served from the JVM classpath or bundled WebJar archives.

Root Cause

The guard in the foldLeft traversal validated segments by exact-string equality against sentinel values only. It failed to reject decoded segments containing / or \, allowing an attacker-controlled encoded separator to survive decoding and reach Path.resolve.

Attack Vector

The attack is executed over the network with no authentication and no user interaction. An attacker crafts an HTTP request whose path contains percent-encoded slashes or backslashes inside segments served by a vulnerable static content route. When the compatible backend forwards the raw encoded path to Http4s, decoding yields directory traversal sequences that resolve to files outside the configured base.

scala

// Vulnerable pattern (pre-patch) vs. fixed pattern from the security commit
F.catchNonFatal {
  segments.foldLeft(rootPath) {
    case (_, "" | "." | "..") => throw BadTraversal
+   case (_, segment) if segment.contains("/") || segment.contains("\\") =>
+     throw BadTraversal
    case (path, segment) => path.resolve(segment)
  }
}
// Source: https://github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3

Detection Methods for CVE-2026-69201

Indicators of Compromise

HTTP request paths containing %2F, %2f, %5C, or %5c sequences targeting routes backed by ResourceService or WebjarService.
Requests containing encoded traversal patterns such as %2E%2E%2F or ..%2F within static asset URLs.
Access log entries for classpath resources or WebJar files that fall outside published static asset paths.

Detection Strategies

Inspect reverse proxy and application access logs for encoded separator characters within URI segments served by Http4s static content routes.
Correlate HTTP 200 responses from static content endpoints with unexpected file extensions, such as .class, .properties, or .conf.
Compare requested asset paths against the expected inventory of published WebJar and classpath resources to flag deviations.

Monitoring Recommendations

Enable request-path logging at the HTTP backend before URI normalization to preserve evidence of encoded separators.
Alert on any static content response returning files not present in the intended asset manifest.
Track deployed Http4s versions across services using a software bill of materials (SBOM) to identify unpatched instances.

How to Mitigate CVE-2026-69201

Immediate Actions Required

Upgrade Http4s to 0.23.35 or 1.0.0-M47, which reject decoded segments containing / or \ in ResourceService, WebjarService, and FileService.
Audit application routes that expose ResourceService or WebjarService handlers and confirm the configured root directories contain only intended assets.
Review the HTTP backend configuration to determine whether encoded separators are preserved in the raw path passed to Http4s.

Patch Information

The fix is delivered in Http4s v0.23.35 and v1.0.0-M47. The patch, tracked in GHSA-crq5-92j2-j7wv and implemented in this commit, adds an explicit separator check inside the segment fold and applies the same guard to FileService for consistency.

Workarounds

Place a reverse proxy in front of Http4s that normalizes or rejects requests containing %2F and %5C before they reach the application.
Temporarily remove or restrict ResourceService and WebjarService routes until upgrade is complete.
Serve static content from a filesystem directory using a validated allow-list rather than a directory-backed classpath.

bash

# Example: update the Http4s dependency in build.sbt
libraryDependencies += "org.http4s" %% "http4s-server" % "0.23.35"
# Or for the 1.x milestone line:
libraryDependencies += "org.http4s" %% "http4s-server" % "1.0.0-M47"