CVE-2026-8023: Zephyr HTTP Server Path Traversal – Information Disclosure

Technical summary

The vulnerability exists in Zephyr's HTTP subsystem (subsys/net/lib/http) when CONFIG_FILE_SYSTEM is enabled and a static-filesystem resource is registered. Both HTTP/1 and HTTP/2 protocol handlers accept the raw request path (from the HTTP/1 request line or HTTP/2 :path pseudo-header) and pass it directly to the resource handler without canonicalization. The static-FS handler then concatenates the configured root directory with the untreated URL and opens the resulting file via fs_open(). Because the underlying filesystem (e.g. LittleFS, FAT) independently resolves .. segments, an attacker-controlled request path containing ./ and ../ sequences bypasses the intended root boundary. Path canonicalization via http_server_remove_dot_segments() is now performed before resource dispatch to both HTTP/1 and HTTP/2 handlers, neutralizing directory traversal.

Business impact

Zephyr devices serving web content via the HTTP server (including IoT, embedded edge devices, and industrial control systems) risk exposure of sensitive data stored on their filesystems. An attacker can remotely enumerate and retrieve configuration files, firmware images, private keys, credentials, logs, or other files resident on accessible storage—without authentication or encryption—potentially leading to further system compromise, credential theft, or supply-chain attacks if the device is part of a managed fleet.

Affected systems

Zephyr releases v4.0.0 through v4.4.0 are affected when: (1) CONFIG_FILE_SYSTEM is enabled, and (2) a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) is registered in the application's HTTP server configuration. Devices or applications that do not register a static-FS resource, or that do not enable filesystem support, are not vulnerable. Verify your application's Kconfig and HTTP resource registration to determine exposure.

Exploitability

Exploitability is high. The vulnerability requires no authentication, encryption, or special setup—only network access to the HTTP server. Exploitation is trivial: a simple GET request with a crafted path (e.g., GET /prefix/../../etc/config) is sufficient. An attacker needs no knowledge of the filesystem layout beyond the configured root; fuzzing of .. sequences will reveal readable files. No special tools, timing, or user interaction are required. CVSS 7.5 (HIGH) reflects the ease of exploitation and the high confidentiality impact.

Remediation

Update to a patched version of Zephyr (v4.4.1 or later, or verify against the vendor advisory for your release branch). The fix implements http_server_remove_dot_segments(), which canonicalizes request paths before the static-FS handler receives them. Apply the patch, rebuild, and redeploy. As an interim mitigation, disable the static-FS resource handler if it is not essential, or restrict network access to the HTTP server via firewall rules. Do not rely on the filesystem's pathname visibility as a security boundary.

Patch guidance

Zephyr maintainers have released fixes in patched versions after v4.4.0. Consult the official Zephyr security advisory and release notes to identify the minimum patched version for your release branch (v4.0.x, v4.1.x, etc.). Update your Zephyr SDK and rebuild all affected applications. After patching, confirm that http_server_remove_dot_segments() is called in the HTTP/1 and HTTP/2 path handlers before resource lookup. Test with path-traversal payloads (e.g., GET /../../../etc/passwd) to verify the fix is in place.

Detection guidance

Monitor HTTP server logs for requests containing ./ or ../ segments in the URL path. These are highly indicative of traversal attempts and should trigger alerts. Log all file-open attempts from the HTTP handler, including the resolved filename; compare against the expected root directory to detect out-of-bounds accesses. Network intrusion detection rules can flag HTTP requests with encoded or raw .. sequences. On resource-constrained devices, sample HTTP logs and flag anomalies. Consider deploying a reverse proxy (if possible) that validates and canonicalizes paths before forwarding to the Zephyr HTTP server.

Why prioritize this

HIGH priority. The vulnerability is unauthenticated, remotely exploitable without user interaction, and results in arbitrary information disclosure. It affects embedded and IoT devices that often store sensitive configuration and firmware on accessible filesystems. The fix is straightforward (path canonicalization) and patched versions are available. Organizations using Zephyr v4.0–v4.4 with static-FS resources should prioritize patching within 30 days to prevent data exfiltration and downstream attacks leveraging exposed credentials or configuration.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is assigned because: (1) Attack Vector is Network—no physical or local access needed. (2) Attack Complexity is Low—no special conditions or timing. (3) Privileges Required: None—unauthenticated. (4) User Interaction: None—attacker-controlled request suffices. (5) Scope: Unchanged—impact is on the Zephyr system itself, not other components. (6) Confidentiality Impact: High—arbitrary files can be read. (7) Integrity and Availability: None—the vulnerability only discloses data, does not modify or deny service. The score reflects a realistic and significant risk to production Zephyr deployments serving files over HTTP.

Frequently asked questions