CVE-2026-82481
Received Received - Intake

Directory Traversal Vulnerability in OCaml Cohttp Library

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: MITRE

Description
The cohttp package before 6.3.0 for OCaml allows directory traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-82481
EUVD
EUVD-2026-68116

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mirage cohttp to 6.3.0 (exc)
mirage cohttp-lwt to 6.3.0 (exc)
mirage cohttp-mirage to 6.3.0 (exc)
mirage cohttp-async to 6.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82481 is a directory traversal vulnerability in the OCaml cohttp library before version 6.3.0. It allows attackers to use URL-encoded path components to escape the intended document root directory by exploiting improper handling of percent-encoded characters in URIs.

Detection Guidance

To detect this vulnerability, inspect OCaml cohttp library versions. Check if cohttp, cohttp-lwt, cohttp-mirage, or cohttp-async versions are below 6.3.0. Use commands like 'opam list cohttp' or 'opam list cohttp-lwt' to verify installed versions.

Impact Analysis

This vulnerability could allow unauthorized access to files outside the intended directory on a server using the affected OCaml cohttp library. Attackers might read sensitive files, modify data, or execute arbitrary code depending on the server's configuration and permissions.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized directory traversal, which may lead to unauthorized access to sensitive data. Directory traversal risks exposing personal or protected health information if exploited.

Mitigation Strategies

Upgrade the OCaml cohttp packages to version 6.3.0 or later. For systems using opam, run 'opam update' followed by 'opam upgrade cohttp cohttp-lwt cohttp-mirage cohttp-async'. Ensure all dependent packages are also updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart