CVE-2020-5280: Local File Inclusion Vulnerability in org.http4s:http4s-server_2.12
Summary
CVE-2020-5280: Local file inclusion vulnerability in http4s. Affects org.http4s:http4s-server_2.12 across 3 version ranges.
< 0.18.26
>= 0.19.0, < 0.20.20
>= 0.21.0, < 0.21.2
Fixed in 0.18.26, 0.20.20 or 0.21.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.http4s:http4s-server_2.12 is a package in the Maven ecosystem that provides server-side functionality for HTTP communication. It includes services such as FileService, ResourceService, and WebjarService, which handle static content delivery. These services are vulnerable to a local file inclusion vulnerability, which can be exploited to expose files and resources outside of the intended location.
Vulnerability Detail
The vulnerability arises from incorrect URI normalization and path escaping in the affected services. An attacker can manipulate the path info to include '../' or '//', allowing them to access files on the local file system or resources on the class path. Additionally, when the services are configured with a non-empty 'pathPrefix' that doesn't end in a slash, directories with names that are a prefix of 'systemPath' or 'pathPrefix' can be exposed. Furthermore, URI decoding is not applied correctly, leading to 404 errors for resources with reserved characters in their names and potential exposure of resources with URI-encoded names.
How To Fix
Latest published version: 1.0-57-0368053 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.18.260.18.26 -
>= 0.19.0, < 0.20.200.20.20 -
>= 0.21.0, < 0.21.20.21.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If an upgrade is not possible, a temporary workaround is to copy the relevant files (FileService.scala, ResourceService.scala, and WebjarService.scala) from the appropriate release series into your project, changing the package name and reference in your application. Another option for users of a servlet backend is to utilize the file serving capabilities of the servlet container.
Conclusion
The local file inclusion vulnerability in org.http4s:http4s-server_2.12 can lead to unauthorized access to files and resources. It is crucial to upgrade to the recommended versions or apply the provided workarounds to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.http4s:http4s-server_2.12 →
FAQ
The vulnerability allows an attacker to access files and resources outside of the intended location, potentially exposing sensitive information or executing arbitrary code.
The vulnerability affects versions 0.18.0 to 0.18.25, 0.19.0 to 0.20.19, and 0.21.0 to 0.21.1 of org.http4s:http4s-server_2.12.
Yes, if an upgrade is not feasible, you can temporarily apply the provided workaround by copying the relevant files into your project or utilizing the file serving capabilities of a servlet container.
The vulnerability was discovered by Thomas Gøytil, who responsibly disclosed it and assisted in testing.
For more information, you can open an issue in the http4s/http4s GitHub repository or contact a maintainer via email.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.http4s:http4s-server_2.12.
