CVE-2020-5280 - CVE House
Back to Database
Status published High CVE-2020-5280

Local file inclusion vulnerability in http4s

Vulnerability Description

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5280

Credits & Attribution

No credits recorded in the NVD database.

References

More from http4s

View All →
CVE-2025-59822
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Medium 6.3
CVE-2023-22465
Http4s has fatal error parsing User-Agent and Server headers
High 7.5
CVE-2021-41084
Response Splitting from unsanitized headers in http4s
High 8.7
CVE-2021-39185
Default CORS config allows any origin with credentials
Critical 9.1
CVE-2021-32643
StaticFile.fromUrl can leak presence of a directory
Medium 5.8

Affected Vendor

Affected Software

http4s
Vulnerable Versions:
< 0.18.26, >= 0.19.0, < 0.20.20, >= 0.21.0, < 0.21.2

Timeline

Official Publish: March 25th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-23

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1105 Ingress Tool Transfer
Command and Control
T1565 Data Manipulation
Impact