PT-2026-53754 · Zephyr · Zephyr

Ret2C · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-8023

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.0.0 through 4.4.0

Description The HTTP server (subsys/net/lib/http) contains a path traversal flaw when using the static-filesystem resource type (HTTP RESOURCE TYPE STATIC FS) with CONFIG FILE SYSTEM enabled. Both HTTP/1 and HTTP/2 front-ends fail to resolve ./.. segments in the request path, which is stored in the client-url buffer variable. The static-FS handler constructs the on-disk filename by concatenating the configured root directory with this raw URL and opens it using the fs open() function. An unauthenticated remote client can use a specially crafted request containing .. segments to escape the configured web root and read arbitrary files on the mounted volume.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, avoid registering static-filesystem resources or disable CONFIG FILE SYSTEM if not required.

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2026-8023

Affected Products

Zephyr

References · 6

• https://github.com/zephyrproject-rtos/zephyr/commit/f4a423c98554f209c5d2f22f041822422c9263b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8023 · Security Note
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hch3-53g6-jj3h · Note
• https://twitter.com/CVEnew/status/2071735281414251003 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2071738277460107576 · Twitter Post
• https://twitter.com/infoflowcloud/status/2071736992262496469 · Twitter Post