Security advisory
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-5280
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:30 UTC · Revision 1
Source evidence
http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
osv:CVE-2020-5280
Complete source record
{
"id": "38d925d60649707caf4520898bc76c6f51d4bf0bce2aecc7793742cac4d43500",
"url": "https://osv.dev/vulnerability/CVE-2020-5280",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-5280",
"summary": "http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.",
"evidence": "osv:CVE-2020-5280",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-5280",
"aliases": [
"CVE-2020-5280",
"GHSA-66q9-f7ff-mmx6"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/http4s/http4s",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "18b23dea4d2d033540dd100103a8d4cf05ae5171"
},
{
"introduced": "d7850459c5be7e9079df6007e6ddf9105973088b"
},
{
"fixed": "4e23069016098b8e36e8f9e0fa42d9b0166bf3b0"
},
{
"introduced": "0801749674a83afa3e7522f4e402d1bedea76982"
},
{
"fixed": "0a46b00a2c92d848e45ff0455e773dbe1b552858"
},
{
"fixed": "250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
},
{
"fixed": "752b3f63a05a31d2de4f8706877aa08d6b89efca"
},
{
"fixed": "b87f31b2292dabe667bec3b04ce66176c8a3e17b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.18.26"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.19.0"
},
{
"fixed": "0.20.20"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.21.0"
},
{
"fixed": "0.21.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "752b3f63a05a31d2de4f8706877aa08d6b89efca"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b87f31b2292dabe667bec3b04ce66176c8a3e17b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.20.19",
"v0.21.1",
"v0.20.18",
"v0.21.0",
"v0.20.17",
"v0.18.25",
"v0.20.16",
"v0.20.15",
"v0.20.14",
"v0.20.11",
"v0.20.10",
"v0.20.9",
"v0.20.8",
"v0.20.7",
"v0.20.6",
"v0.20.4",
"v0.20.3",
"v0.18.24",
"v0.20.2",
"v0.20.1",
"v0.20.0",
"v0.20.0-RC1",
"v0.20.0-M7",
"v0.18.23",
"v0.18.22",
"v0.20.0-M6",
"v0.20.0-M5",
"v0.20.0-M4",
"v0.20.0-M3",
"v0.20.0-M2",
"v0.18.21",
"v0.20.0-M1",
"v0.18.20",
"v0.19.0",
"v0.18.19",
"v0.18.18",
"v0.18.17",
"v0.18.16",
"v0.18.15",
"v0.18.14",
"v0.18.13",
"v0.18.12",
"v0.18.11",
"v0.18.10",
"v0.18.9",
"v0.18.8",
"v0.18.7",
"v0.18.6",
"v0.18.5",
"v0.18.4",
"v0.18.3",
"v0.18.2",
"v0.18.1",
"v0.18.0",
"v0.18.0-M9",
"v0.18.0-M8",
"v0.18.0-M7",
"v0.18.0-M6",
"v0.18.0-M5",
"v0.18.0-M4",
"v0.18.0-M3",
"v0.18.0-M2",
"v0.18.0-M1",
"v0.17.0-M1",
"v0.14.1",
"v0.14.0",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.9.0",
"v0.8.1",
"v0.7.0",
"v0.6.0",
"v0.5.0",
"v0.3.0",
"v0.2.0",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5280.json"
}
}
],
"modified": "2026-10-20T10:54:24.878507223Z",
"provider": "osv",
"references": [
"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6",
"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec",
"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca",
"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-5280",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 385325,
"published_at": "2020-03-25T18:15:14.237+00:00"
}