CVE-2026-82481: Cohttp OCaml Path Traversal Vulnerability

CVE-2026-82481 Overview

The cohttp package before version 6.3.0 for OCaml contains a directory traversal vulnerability. The flaw allows remote attackers to access files outside the intended web root by manipulating request paths. Cohttp is a widely used HTTP client and server library in the OCaml ecosystem, so the impact extends across applications that depend on it for serving static content.

The issue is tracked as [CWE-180: Incorrect Behavior Order: Validate Before Canonicalize] and was resolved in cohttp 6.3.0 following discussion in the upstream repository.

Critical Impact
Unauthenticated network attackers can read arbitrary files from the host filesystem by supplying crafted path traversal sequences to HTTP endpoints served by vulnerable cohttp versions.

Affected Products

cohttp package for OCaml, all versions prior to 6.3.0
Applications and services built on cohttp-lwt-unix or cohttp-async that serve filesystem content
Downstream OCaml projects bundling vulnerable cohttp releases

Discovery Timeline

2026-08-29 - CVE-2026-82481 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82481

Vulnerability Analysis

The vulnerability is a directory traversal weakness in the cohttp OCaml HTTP library. When cohttp serves files based on the request path, it fails to correctly canonicalize the path before applying its access checks. Attackers can supply request URIs containing ../ sequences or encoded variants to escape the intended document root.

Because cohttp validates path components before canonicalization, sequences that resolve to parent directories bypass the check. The result is that filesystem resources outside the intended serving directory become reachable through standard HTTP requests.

Exploitation requires only network access to a service that uses cohttp for file serving. No authentication, user interaction, or elevated privileges are needed. The impact is limited to confidentiality of files readable by the service process, with no direct effect on integrity or availability of the underlying application.

Root Cause

The root cause is classified as [CWE-180]: the library validates path segments before canonicalizing the full path. Traversal tokens embedded in the URL survive validation and are later resolved against the filesystem. The upstream fix, discussed in ocaml-cohttp pull request #1145, reorders validation to occur after path canonicalization and rejects requests that resolve outside the configured root.

Attack Vector

An attacker sends an HTTP request with a path such as /static/../../etc/passwd or URL-encoded equivalents like %2e%2e%2f sequences. The cohttp file handler resolves the path against the filesystem and returns the contents of the referenced file if the service process has read permission. Refer to the upstream GitHub pull request discussion for the specific handler code paths involved.

Detection Methods for CVE-2026-82481

Indicators of Compromise

HTTP request logs containing ../, ..\, %2e%2e%2f, or %2e%2e/ sequences in URI paths
Successful 200 OK responses to requests targeting paths outside expected static directories
Access to sensitive files such as /etc/passwd, application configuration files, or private keys via the web service
Unusual User-Agent strings combined with high volumes of path-probing requests

Detection Strategies

Inspect web server and reverse proxy logs for path traversal patterns in URIs handled by OCaml services
Deploy web application firewall rules that block traversal sequences before requests reach cohttp handlers
Enumerate OCaml deployments and confirm the installed cohttp version using opam list cohttp

Monitoring Recommendations

Alert on outbound file reads by cohttp-based service processes outside their designated document root
Baseline normal URI patterns for each cohttp-backed endpoint and flag deviations
Correlate HTTP 200 responses to traversal-shaped requests with file access telemetry on the host

How to Mitigate CVE-2026-82481

Immediate Actions Required

Upgrade the cohttp package to version 6.3.0 or later on all OCaml build and runtime environments
Rebuild and redeploy any applications statically linked against vulnerable cohttp releases
Audit HTTP access logs for prior exploitation attempts targeting sensitive file paths
Restrict filesystem permissions of the service account running cohttp-based servers to the minimum required

Patch Information

The vulnerability is fixed in cohttp 6.3.0. The remediation was merged upstream through ocaml-cohttp pull request #1145, which corrects the validation ordering so path canonicalization occurs before access checks. Update via opam update && opam install cohttp.6.3.0 and rebuild dependent projects.

Workarounds

Place a reverse proxy such as nginx or HAProxy in front of cohttp services and reject requests containing .. sequences or encoded traversal tokens
Serve static content from a chroot or container namespace so filesystem access is bounded even if traversal succeeds
Disable static file serving entirely in cohttp handlers when not required and route through a hardened proxy instead

bash

# Configuration example: upgrade cohttp with opam
opam update
opam install cohttp.6.3.0 cohttp-lwt-unix.6.3.0
opam list cohttp