OSEC-2026-16
Path traversal in Cohttp.Path.resolve_local_file
The issue is that the function normalizes the URI path before percent decoding it:
let resolve_local_file ~docroot ~uri =
let path = Uri.(pct_decode (path (resolve "http" (of_string "/") uri))) in
...
Because %2f is decoded after Uri.resolve, encoded separators survive
dot-segment normalization. For example, a request path like:
/static/..%2f..%2f..%2fetc/passwd
is normalized as a single encoded segment, then decoded into:
/static/../../../etc/passwd
afterwards.
Timeline
- Aug 11th 2026: report to [email protected]
- Aug 14th 2026: PR published on https://github.com/mirage/ocaml-cohttp/pull/1145
- Aug 20th 2026: fix released in v6.3.0 https://github.com/ocaml/opam-repository/pull/30528
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
OSV Score used
Path traversal in Cohttp.Path.resolve_local_file
The issue is that the function normalizes the URI path before percent decoding it:
let resolve_local_file ~docroot ~uri =
let path = Uri.(pct_decode (path (resolve "http" (of_string "/") uri))) in
...
Because %2f is decoded after Uri.resolve, encoded separators survive
dot-segment normalization. For example, a request path like:
/static/..%2f..%2f..%2fetc/passwd
is normalized as a single encoded segment, then decoded into:
/static/../../../etc/passwd
afterwards.
Timeline
- Aug 11th 2026: report to [email protected]
- Aug 14th 2026: PR published on https://github.com/mirage/ocaml-cohttp/pull/1145
- Aug 20th 2026: fix released in v6.3.0 https://github.com/ocaml/opam-repository/pull/30528
- Record
OSEC-2026-16- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:M - Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cohttpopam |
before 6.3.0, plus listed versions 0.9.10.9.20.9.30.9.40.9.5 Show 45 moreShow less0.9.60.9.70.9.80.9.90.9.100.9.110.9.120.9.130.9.140.9.150.9.160.10.00.10.10.11.00.11.10.11.20.12.00.13.00.14.00.15.00.15.10.15.20.16.00.16.10.17.00.17.10.17.20.18.00.18.10.18.20.18.30.19.00.19.10.19.20.19.30.20.00.20.10.20.20.21.00.21.10.22.00.99.01.0.01.0.21.1.0 |
6.3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSEC-2026-16 is a high vulnerability (CVSS 8.7) in cohttp, published August 20, 2026. No source lists public exploit code. Fixed in cohttp 6.3.0.
Left out here: 36 versions. The JSON record has them.