The Mirage cohttp package before version 6.3.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive files on the host system.

This is a directory traversal vulnerability (CWE-180) occurring because the software validates input incorrectly before canonicalization. An unauthenticated attacker can exploit this flaw to bypass path restrictions and access unauthorized files outside the intended web directory.

The ability to perform directory traversal poses a significant risk to data confidentiality, as it allows attackers to read arbitrary files from the server filesystem. With a CVSS score of 8.7, this is a high-severity issue that could lead to the exposure of configuration files, credentials, or proprietary source code. Such unauthorized access can result in severe reputational damage and potential regulatory non-compliance.

Immediate Action: Update the cohttp package to version 6.3.0 or later to incorporate the necessary validation logic fixes.

Proactive Monitoring: Review web server and application logs for suspicious URL patterns, such as sequences involving double dots (../) or encoded characters used in traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and malicious path normalization attempts.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the nature of the vulnerability, this issue presents a clear risk to system integrity and data privacy. Administrators should prioritize updating the cohttp dependency in all OCaml projects to version 6.3.0 immediately to eliminate this attack vector.