EUVD-2026-68116

The cohttp package before 6.3.0 for OCaml allows directory traversal...

CVE-2026-82481

CVE-2026-82481 affects the cohttp HTTP client/server library for OCaml , prior to version 6.3.0 , which allows directory traversal . The CVSS 4.0 base score is 8.7 (HIGH) , with a HIGH confidentiality impact on the vulnerable system, low attack complexity, and no privileges or user interaction re...

OSEC-2026-16 Path traversal in Cohttp.Path.resolve_local_file

The issue is that the function normalizes the URI path before percent decoding it: OCaml let resolvelocalfile docroot uri = let path = Uri.pctdecode path resolve "http" ofstring "/" uri in ... Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For...