The cohttp package for OCaml, prior to version 6.3.0, contains a directory traversal vulnerability rooted in CWE‑180. An attacker through crafted input can cause the server to read files outside the intended directory, potentially exposing sensitive data such as configuration files, logs, or private source code.

Mirage’s cohttp library, used in OCaml projects, is affected in all releases before 6.3.0. No other vendor or product is listed. If a system incorporates an older cohttp dependency, it is vulnerable.

The CVSS score is 8.7, indicating high severity, although no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker sends a request that contains a path containing ".." or other traversal sequences. If the application exposes cohttp to unauthenticated users, the attacker may read arbitrary files; if authentication is required, the risk is still high but mitigated to the extent that the attacker has valid credentials. The lack of exploitation data suggests that the vulnerability may not be widely used yet, but its high severity warrants immediate action.