Directory Traversal Vulnerability in Zephyr's HTTP Server

CVE-2026-8023

What is CVE-2026-8023?

The HTTP server in Zephyr is susceptible to a directory traversal vulnerability due to improper handling of URL paths. Attackers can exploit this vulnerability to read arbitrary files from the filesystem, as the server does not resolve directory traversal sequences in the URL. Before being patched, this issue allowed unauthenticated remote clients to access sensitive files, potentially leading to information disclosure. The vulnerability affects specific releases of Zephyr with static-filesystem resource capabilities. A fix has been implemented to sanitize URL paths, mitigating the risk of unauthorized file access.

References