Http4s is a Scala framework that exposes HTTP services. The vulnerability allows a web client to craft a request whose or backslash (\\) separators are decoded by the server, turning an otherwise accepted path segment into an ancestor directory reference. When the backend serves resources from a directory‑backed classpath and preserves the encoded separator, the attacker can access files or WebJar resources outside the intended base directory, potentially exposing sensitive configuration or source files. The flaw is a classic directory traversal conflated with improper path sanitization, classified as CWE‑22.

The issue exists in http4s versions prior to 0.23.35 and 1.0.0‑M47. The fix is included in releases 0.23.35 and 1.0.0‑M47 and later.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of <1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending a URL containing a percent‑encoded slash or backslash, which is interpreted after decoding as a path separator. No authentication is required if the affected service is publicly reachable, though the ability to read arbitrary files is limited to directory‑backed classpath or WebJar resources configured by the application.