CVE-2026-82481

CVE-2026-82481 is a directory traversal flaw (CWE-180, incorrect handling of relative paths) in the cohttp HTTP library for OCaml, fixed in version 6.3.0. A remote, unauthenticated attacker can send crafted HTTP requests containing relative path components (such as ../ sequences) that escape the intended directory root, and the library resolves them incorrectly. The CVSS 4.0 vector shows network attack with no privileges or user interaction and high confidentiality impact only, meaning the attacker gains the ability to read arbitrary files accessible to the server process, such as configuration files or credentials, with no modification or disruption. Any application or service built with cohttp and using its HTTP server functionality to serve files from a directory is affected if it runs cohttp versions prior to 6.3.0. There is no known public proof-of-concept, the flaw is not listed in CISA KEV, and EPSS puts 30-day exploitation probability at only about 0.5%.

What to do: Upgrade any OCaml applications using cohttp to version 6.3.0 or later. If upgrading is not immediately possible, restrict or patch file-serving endpoints to normalize request paths and reject path components containing '..' before resolving them, and review which cohttp-based services are exposed to untrusted networks.