ANT-2026-VHDP7ANW
Path traversal in the HTTP.jl static file server via separator/absolute path segments
Description
The static file server decoded the request path, split it on /, and rejected only segments exactly equal to . or ... Because URL-decoding ran before the / split, an encoded backslash (%5c), a Windows drive specifier (C:\...), or a UNC prefix (\\host\share) survived inside a single segment and passed validation. On Windows, joinpath then honored \ as a separator and treated drive/UNC segments as absolute, discarding the configured document root.
Impact
A remote client could read files outside the served document root and, on Windows, trigger outbound SMB/NTLM authentication via UNC paths, by crafting encoded separator, drive, or UNC segments.
Patches
Fixed in HTTP.jl v2.4.0. A new platform-independent segment validator rejects any decoded segment that is ./.., contains a path separator (/ or \), contains a colon (drive specifier / alternate data stream), or is absolute; unsafe segments are mapped to a 400 response. A defense-in-depth containment backstop additionally requires the normalized joined path to remain within the normalized root.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
What each source reports
OSVJLSEC-2026-612No score
Path traversal in the HTTP.jl static file server via separator/absolute path segments
Description
The static file server decoded the request path, split it on /, and rejected only segments exactly equal to . or ... Because URL-decoding ran before the / split, an encoded backslash (%5c), a Windows drive specifier (C:\...), or a UNC prefix (\\host\share) survived inside a single segment and passed validation. On Windows, joinpath then honored \ as a separator and treated drive/UNC segments as absolute, discarding the configured document root.
Impact
A remote client could read files outside the served document root and, on Windows, trigger outbound SMB/NTLM authentication via UNC paths, by crafting encoded separator, drive, or UNC segments.
Patches
Fixed in HTTP.jl v2.4.0. A new platform-independent segment validator rejects any decoded segment that is ./.., contains a path separator (/ or \), contains a colon (drive specifier / alternate data stream), or is absolute; unsafe segments are mapped to a 400 response. A defense-in-depth containment backstop additionally requires the normalized joined path to remain within the normalized root.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
- Record
JLSEC-2026-612- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HTTPJulia | before 2.4.0 | 2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
ANT-2026-VHDP7ANW is a vulnerability with no CVSS score yet in HTTP, published June 23, 2026. No source lists public exploit code. Fixed in HTTP 2.4.0.