{"id":"ANT-2026-VHDP7ANW","aliases":["JLSEC-2026-612"],"status":"published","title":"Path traversal in the HTTP.jl static file server via separator/absolute path segments","description":"### Description\n\nThe static file server decoded the request path, split it on `/`, and rejected only segments exactly equal to `.` or `..`. Because URL-decoding ran before the `/` split, an encoded backslash (`%5c`), a Windows drive specifier (`C:\\...`), or a UNC prefix (`\\\\host\\share`) survived inside a single segment and passed validation. On Windows, `joinpath` then honored `\\` as a separator and treated drive/UNC segments as absolute, discarding the configured document root.\n\n### Impact\n\nA remote client could read files outside the served document root and, on Windows, trigger outbound SMB/NTLM authentication via UNC paths, by crafting encoded separator, drive, or UNC segments.\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. A new platform-independent segment validator rejects any decoded segment that is `.`/`..`, contains a path separator (`/` or `\\`), contains a colon (drive specifier / alternate data stream), or is absolute; unsafe segments are mapped to a 400 response. A defense-in-depth containment backstop additionally requires the normalized joined path to remain within the normalized root.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T14:00:03Z","fixes":[{"ecosystem":"Julia","package":"HTTP","fixed_in":["2.4.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"HTTP","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]}],"references":[{"url":"https://github.com/JuliaWeb/HTTP.jl/commit/86bf638796e08661a8b269d2db8ae40ff8cdaf05","tags":["web"]},{"url":"https://github.com/JuliaWeb/HTTP.jl/pull/1316","tags":["web"]}],"sources":{"osv":[{"id":"JLSEC-2026-612","title":"Path traversal in the HTTP.jl static file server via separator/absolute path segments","description":"### Description\n\nThe static file server decoded the request path, split it on `/`, and rejected only segments exactly equal to `.` or `..`. Because URL-decoding ran before the `/` split, an encoded backslash (`%5c`), a Windows drive specifier (`C:\\...`), or a UNC prefix (`\\\\host\\share`) survived inside a single segment and passed validation. On Windows, `joinpath` then honored `\\` as a separator and treated drive/UNC segments as absolute, discarding the configured document root.\n\n### Impact\n\nA remote client could read files outside the served document root and, on Windows, trigger outbound SMB/NTLM authentication via UNC paths, by crafting encoded separator, drive, or UNC segments.\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. A new platform-independent segment validator rejects any decoded segment that is `.`/`..`, contains a path separator (`/` or `\\`), contains a colon (drive specifier / alternate data stream), or is absolute; unsafe segments are mapped to a 400 response. A defense-in-depth containment backstop additionally requires the normalized joined path to remain within the normalized root.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","status":"published","published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T14:00:03.469610146Z","updated_at":"2026-11-02T15:47:18.573531Z"}]}}