CVE-2026-69201: Http4s: ResourceService and Webjar Service path escape via percent-encoded separators
The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator (%2F) lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources that should not be public.
On Windows, a similar attack exists with (%5C).
References
- github.com/advisories/GHSA-crq5-92j2-j7wv
- github.com/http4s/http4s/commit/bcd99cdc1342ef58a0f132acb814af06a668a8d3
- github.com/http4s/http4s/releases/tag/v0.23.35
- github.com/http4s/http4s/releases/tag/v1.0.0-M47
- github.com/http4s/http4s/security/advisories/GHSA-crq5-92j2-j7wv
- nvd.nist.gov/vuln/detail/CVE-2026-69201
Code Behaviors & Features
Detect and mitigate CVE-2026-69201 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →