CVE-2026-8023: Zephyr HTTP Server Path Traversal Flaw

CVE-2026-8023 Overview

CVE-2026-8023 is a path traversal vulnerability [CWE-22] in the Zephyr real-time operating system's HTTP server component (subsys/net/lib/http). The flaw affects deployments that register a static-filesystem resource using HTTP_RESOURCE_TYPE_STATIC_FS with CONFIG_FILE_SYSTEM enabled. Both HTTP/1 and HTTP/2 front-ends copy the raw request path into the URL buffer without resolving . or .. segments. An unauthenticated remote attacker can send a crafted request such as GET /<prefix>/../../<file> to read arbitrary readable files on the mounted volume. The issue affects Zephyr releases v4.0.0 through v4.4.0.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the mounted filesystem volume of embedded Zephyr devices exposing an HTTP server with a static-FS resource.

Affected Products

Zephyr RTOS v4.0.0
Zephyr RTOS releases through v4.4.0
Deployments registering HTTP_RESOURCE_TYPE_STATIC_FS with CONFIG_FILE_SYSTEM enabled

Discovery Timeline

2026-06-29 - CVE-2026-8023 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-8023

Vulnerability Analysis

The Zephyr HTTP server exposes a static filesystem resource handler for serving files from a configured root directory. The HTTP/1 front-end assembles the request path in on_url(), while the HTTP/2 front-end copies the :path pseudo-header verbatim. Both paths land in client->url_buffer without canonicalization.

The static-FS handler constructs the on-disk filename by directly concatenating the configured root with the attacker-controlled URL. The relevant call is snprintk(fname, ..., "%s%s", static_fs_detail->fs_path, client->url_buffer) at http_server_http1.c:603 and http_server_http2.c:490. The handler then invokes fs_open(fname, FS_O_READ).

Because the handler is dispatched through wildcard or leading-directory matching (fnmatch with FNM_LEADING_DIR), attackers can reach it with any prefix. The underlying filesystem (such as LittleFS or FAT) resolves .. segments during fs_open, allowing escape from the configured web root.

Root Cause

The root cause is missing path normalization before resource lookup. Neither protocol handler resolves . or .. segments in the URL path prior to building the filesystem path. The HTTP server requires no TLS or authentication to reach the vulnerable code path, exposing the flaw to unauthenticated network attackers.

Attack Vector

An attacker sends an HTTP GET request with .. segments in the path to any endpoint served by the static-FS handler. The filesystem driver resolves the traversal during fs_open, returning contents outside the configured root directory.

/* Patch: http_server_remove_dot_segments() canonicalizes the path
 * portion of the URL before resource lookup in both protocol handlers.
 * Source: https://github.com/zephyrproject-rtos/zephyr/commit/f4a423c98554f209c5d2f22f041822422c9263b8
 */
void http_server_remove_dot_segments(char *path)
{
	char *in = path;
	char *out = path;
	char *query = strpbrk(path, "?#");
	size_t qtail_len = (query != NULL) ? strlen(query) : 0;

	while ((*in != '\0') && (in != query)) {
		if (in[0] == '.') {
			if (in[1] == '/') {
				in += 2;
				continue;
			} else if ((in[1] == '.') && (in[2] == '/')) {
				in += 3;
				continue;
			} else if ((in[1] == '\0') || (in + 1 == query)) {
				in += 1;
				continue;
			} else if ((in[1] == '.') &&
					((in[2] == '\0') || (in + 2 == query))) {
				in += 2;
				continue;
			}

Source: Zephyr commit f4a423c9

Detection Methods for CVE-2026-8023

Indicators of Compromise

HTTP request logs containing ..%2F, ../, or encoded traversal sequences targeting Zephyr device endpoints
Access log entries showing successful 200 OK responses to URLs containing .. segments served by static-FS resources
Unexpected reads of sensitive files stored on the LittleFS or FAT volume mounted by the device

Detection Strategies

Inspect HTTP request paths at network edge devices or reverse proxies for path traversal sequences before requests reach Zephyr endpoints
Deploy network intrusion detection signatures matching ../ and URL-encoded variants against HTTP traffic destined for embedded devices
Audit Zephyr firmware builds for HTTP_RESOURCE_TYPE_STATIC_FS registrations combined with CONFIG_FILE_SYSTEM enabled

Monitoring Recommendations

Enable HTTP request logging on the Zephyr device or fronting proxy and forward logs to a central SIEM for path traversal pattern matching
Alert on repeated 200 responses to paths containing .. from a single source IP against embedded HTTP endpoints
Monitor filesystem access patterns on the device where feasible to detect reads outside the intended web root

How to Mitigate CVE-2026-8023

Immediate Actions Required

Upgrade Zephyr to a release containing commit f4a423c9 which adds http_server_remove_dot_segments() path canonicalization
Remove or restrict HTTP_RESOURCE_TYPE_STATIC_FS resources from production firmware where static file serving is not required
Place affected devices behind a reverse proxy that normalizes and validates HTTP paths before forwarding to Zephyr

Patch Information

The fix introduces http_server_remove_dot_segments() in subsys/net/lib/http/http_server_core.c and calls it from both HTTP/1 and HTTP/2 front-ends before resource lookup. The function performs an in-place canonicalization of the path portion, preserving query and fragment components. See the Zephyr Security Advisory GHSA-hch3-53g6-jj3h and the upstream commit f4a423c9 for the complete patch.

Workarounds

Disable CONFIG_FILE_SYSTEM in Zephyr builds that do not require filesystem support to eliminate the vulnerable code path
Segregate sensitive files onto a separate mount point that is not exposed via the static-FS root directory
Deploy a web application firewall or reverse proxy in front of the device to strip or reject .. sequences from HTTP request paths

bash

# Verify Zephyr version and rebuild against a patched release
west update
cd zephyr
git log --oneline | grep -i "http_server_remove_dot_segments"
# Confirm the fix commit f4a423c9 is present, then rebuild firmware
west build -b <board> -p always <app>