{"id":"CVE-2020-5280","published":"2020-03-25T17:45:17Z","modified":"2024-08-04T08:22:09Z","title":"Local file inclusion vulnerability in http4s","vendor":"http4s","product":"http4s","tier":"tail","description":{"text":"http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.06985,"percentile":0.9413,"provenance":"source"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec","tags":["x_refsource_MISC"]},{"url":"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca","tags":["x_refsource_MISC"]},{"url":"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b","tags":["x_refsource_MISC"]}],"priority":{"score":24.1,"factors":[{"name":"EPSS percentile","points":18.83},{"name":"CVSS severity","points":5.32}]},"vendorSlug":"http4s","affectedVersions":[{"vendor":"http4s","product":"http4s","versions":["< 0.18.26",">= 0.19.0, < 0.20.20",">= 0.21.0, < 0.21.2"]}],"affected":[{"ecosystem":"Maven","package":"org.http4s:http4s-server_2.12","vulnerableRanges":["<0.18.26",">=0.19.0, <0.20.20",">=0.21.0, <0.21.2"],"patched":["0.18.26","0.20.20","0.21.2"],"from":["GHSA-66q9-f7ff-mmx6"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0333","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-http4s-cve-2020-5280","children":[{"from":"CVE-2020-5280","to":"CVE-2021-21294","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["build.sbt","project/plugins.sbt"],"commits":["https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec","https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca","https://github.com/http4s/http4s/commit/987d6589ef79545b9bb2324ac4bdebf82d9a0171"],"basis":"shared function","functions":["libraryProject"]}]},{"from":"CVE-2020-5280","to":"CVE-2021-41084","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["build.sbt"],"commits":["https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec","https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca","https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"],"basis":"shared function","functions":["libraryProject"]}]}],"packageHistory":[{"cve":"CVE-2020-5280","published":"2020-03-25","fixed":"0.21.2","kev":false},{"cve":"CVE-2021-39185","published":"2021-09-01","fixed":"0.23.2","kev":false,"link":{"from":"CVE-2020-5280","to":"CVE-2021-39185","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.http4s:http4s-server_2.12","fromFixed":"0.21.2","toFixed":"0.21.27","daysApart":525}]}},{"cve":"CVE-2021-41084","published":"2021-09-21","fixed":"0.23.4","kev":false},{"cve":"CVE-2026-69201","published":"2026-09-15","fixed":"0.23.35","kev":false}],"package":"Maven:org.http4s:http4s-server_2.12"}}