CVE-2026-8023: Path traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file read
Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTPRESOURCETYPESTATICFS, available when CONFIGFILESYSTEM is enabled) that serves files from a configured root directory. Before this fix, both the HTTP/1 and HTTP/2 front-ends placed the raw, attacker-controlled request path into client->urlbuffer (assembled in onurl() for HTTP/1 and copied verbatim from the :path pseudo-header for HTTP/2) without resolving ./.. segments. The static-FS handler then built the on-disk filename by directly concatenating the configured root with that raw URL (snprintk(fname, ..., "%s%s", staticfsdetail->fspath, client->urlbuffer) at httpserverhttp1.c:603 and httpserverhttp2.c:490) and opened it with fsopen(fname, FSOREAD). Because the handler is reached via wildcard/leading-dir (fnmatch FNMLEADINGDIR) or fallback resource matching, a request such as GET /<prefix>/../../<file> is dispatched to the handler and, after the underlying filesystem (e.g. LittleFS/FAT) resolves the .. segments, escapes the configured web root, letting an unauthenticated remote client read arbitrary readable files on the mounted volume (information disclosure). The HTTP server requires no TLS or authentication to reach this path. The fix adds httpserverremovedotsegments(), which canonicalizes the path portion of the URL before resource lookup in both protocol handlers, neutralizing the traversal. Affects releases v4.0.0 through v4.4.0 for deployments that register a static-filesystem resource.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zephyr HTTP server (subsys/net/lib/http) static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS)to a version that resolves this vulnerability.Fixed in 4.4.0 - Configuration
Apply the fix that adds http_server_remove_dot_segments() so both HTTP/1 (on_url) and HTTP/2 (:path pseudo-header) canonicalize the URL path portion before resource lookup, neutralizing traversal via wildcard/leading-dir (FNM_LEADING_DIR) or fallback resource matching.
Zephyr HTTP server (subsys/net/lib/http) static-filesystem resource path handling = canonicalize URL path before resource lookup using http_server_remove_dot_segments() - Compensating control
Restrict network access to the Zephyr HTTP server endpoints (it requires no TLS or authentication to reach the vulnerable path) using firewall/ACL so unauthenticated clients cannot reach the static-filesystem resource.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8023?
CVE-2026-8023 has a severity score of 7.5, indicating a high level of risk.
How does CVE-2026-8023 affect the Zephyr HTTP server?
CVE-2026-8023 allows unauthenticated remote attackers to perform arbitrary file reads due to a path traversal vulnerability.
How do I fix CVE-2026-8023?
To fix CVE-2026-8023, ensure you are using the latest version of the Zephyr HTTP server that includes security patches for this vulnerability.
What type of attack is CVE-2026-8023 associated with?
CVE-2026-8023 is associated with path traversal attacks, enabling attackers to access sensitive files on the server.
Who is affected by CVE-2026-8023?
Any application using the vulnerable version of the Zephyr HTTP server with the static-filesystem resource handler enabled is at risk from CVE-2026-8023.