{"affected":[{"affectedData":[{"product":"http4s","vendor":"http4s","versions":[{"status":"affected","version":"< 0.18.26"},{"status":"affected","version":">= 0.19.0, < 0.20.20"},{"status":"affected","version":">= 0.21.0, < 0.21.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","matchCriteriaId":"D8F27ABA-D902-4EFB-AA8A-1C1A3637517A","versionEndExcluding":"0.18.26","vulnerable":true},{"criteria":"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","matchCriteriaId":"1B72AEE1-950A-4AB8-9620-A9E4DE39ACEB","versionEndExcluding":"0.20.20","versionStartIncluding":"0.19.0","vulnerable":true},{"criteria":"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*","matchCriteriaId":"15358AD5-7CD3-4EC2-B986-6115420D15D8","versionEndExcluding":"0.21.2","versionStartIncluding":"0.21.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported."},{"lang":"es","value":"http4s versiones anteriores a 0.18.26, 0.20.20 y 0.21.2, presenta una vulnerabilidad de inclusión de archivos local. Esta vulnerabilidad se aplica a todos los usuarios de org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService y org.http4s.server.staticcontent.WebjarService. La normalización de URI es aplicada incorrectamente. Las peticiones cuya información de ruta contiene ../ o // pueden exponer recursos fuera de la ubicación configurada. Este problema está parcheado en las versiones 0.18.26, 0.20.20 y 0.21.2. Tome en cuenta que la versión 0.19.0 es una versión en desuso y nunca ha sido compatible."}],"id":"CVE-2020-5280","lastModified":"2026-06-17T03:21:11.577","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-03-25T18:15:14.237","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"},{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"},{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/250afddbb2e65b70ca9ddaec9d1eb3aaa56de7ec"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/752b3f63a05a31d2de4f8706877aa08d6b89efca"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"url":"https://github.com/http4s/http4s/commit/b87f31b2292dabe667bec3b04ce66176c8a3e17b"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/http4s/http4s/security/advisories/GHSA-66q9-f7ff-mmx6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"nvd@nist.gov","type":"Primary"}]}