PT-2026-83662 — Git Cohttp

PT-2026-83662 · Git · Cohttp

Published

2026-08-20

Updated

2026-08-20

CVSS v4.0

8.7

High

Vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:M

The issue is that the function normalizes the URI path before percent decoding it:

OCaml

let resolve local file ~docroot ~uri =

 let path = Uri.(pct decode (path (resolve "http" (of string "/") uri))) in

 ...

Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For example, a request path like:

/static/..%2f..%2f..%2fetc/passwd

is normalized as a single encoded segment, then decoded into:

/static/../../../etc/passwd

afterwards.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

OSEC-2026-16

Cohttp