PT-2026-83662
Published
2026-08-20
·
Updated
2026-08-20
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:M
The issue is that the function normalizes the URI path before percent
decoding it:
OCaml
let resolve local file ~docroot ~uri =
let path = Uri.(pct decode (path (resolve "http" (of string "/") uri))) in
...Because
%2f is decoded after Uri.resolve, encoded separators survive
dot-segment normalization. For example, a request path like:/static/..%2f..%2f..%2fetc/passwdis normalized as a single encoded segment, then decoded into:
/static/../../../etc/passwdafterwards.
Timeline
- Aug 11th 2026: report to security@ocaml.org
- Aug 14th 2026: PR published on https://github.com/mirage/ocaml-cohttp/pull/1145
- Aug 20th 2026: fix released in v6.3.0 https://github.com/ocaml/opam-repository/pull/30528
Exploitability
Fix
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾