{"id":"CVE-2020-5280","details":"http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.","aliases":["GHSA-66q9-f7ff-mmx6"],"modified":"2026-07-09T01:31:30.975138Z","published":"2020-03-25T18:15:14.237Z","references":[{"type":"ADVISORY","url":"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"},{"type":"FIX","url":"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/http4s/http4s","events":[{"introduced":"0"},{"fixed":"18b23dea4d2d033540dd100103a8d4cf05ae5171"},{"introduced":"d7850459c5be7e9079df6007e6ddf9105973088b"},{"fixed":"4e23069016098b8e36e8f9e0fa42d9b0166bf3b0"},{"introduced":"0801749674a83afa3e7522f4e402d1bedea76982"},{"fixed":"0a46b00a2c92d848e45ff0455e773dbe1b552858"},{"fixed":"250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"},{"fixed":"752b3f63a05a31d2de4f8706877aa08d6b89efca"},{"fixed":"b87f31b2292dabe667bec3b04ce66176c8a3e17b"}],"database_specific":{"cpe":"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.18.26"},{"introduced":"0.19.0"},{"fixed":"0.20.20"},{"introduced":"0.21.0"},{"fixed":"0.21.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.20.19","v0.21.1","v0.20.18","v0.21.0","v0.20.17","v0.18.25","v0.20.16","v0.20.15","v0.20.14","v0.20.11","v0.20.10","v0.20.9","v0.20.8","v0.20.7","v0.20.6","v0.20.4","v0.20.3","v0.18.24","v0.20.2","v0.20.1","v0.20.0","v0.20.0-RC1","v0.20.0-M7","v0.18.23","v0.18.22","v0.20.0-M6","v0.20.0-M5","v0.20.0-M4","v0.20.0-M3","v0.20.0-M2","v0.18.21","v0.20.0-M1","v0.18.20","v0.19.0","v0.18.19","v0.18.18","v0.18.17","v0.18.16","v0.18.15","v0.18.14","v0.18.13","v0.18.12","v0.18.11","v0.18.10","v0.18.9","v0.18.8","v0.18.7","v0.18.6","v0.18.5","v0.18.4","v0.18.3","v0.18.2","v0.18.1","v0.18.0","v0.18.0-M9","v0.18.0-M8","v0.18.0-M7","v0.18.0-M6","v0.18.0-M5","v0.18.0-M4","v0.18.0-M3","v0.18.0-M2","v0.18.0-M1","v0.17.0-M1","v0.14.1","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.1","v0.7.0","v0.6.0","v0.5.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-5280.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}