CVE-2026-69201: Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.
On Windows, a similar attack exists with (%5C).
References
- github.com/advisories/GHSA-crq5-92j2-j7wv
- github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv
- nvd.nist.gov/vuln/detail/CVE-2026-69201
Code Behaviors & Features
Detect and mitigate CVE-2026-69201 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →