PT-2026-83662 — Git Cohttp

PT-2026-83662 · Git · Cohttp

Publicado

2026-08-20

Atualizado

2026-08-20

CVSS v4.0

8.7

Alta

Vetor

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:M

The issue is that the function normalizes the URI path before percent decoding it:

OCaml

let resolve local file ~docroot ~uri =

 let path = Uri.(pct decode (path (resolve "http" (of string "/") uri))) in

 ...

Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For example, a request path like:

/static/..%2f..%2f..%2fetc/passwd

is normalized as a single encoded segment, then decoded into:

/static/../../../etc/passwd

afterwards.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

OSEC-2026-16

Cohttp