Loading vulnerability…
CVE-2026-8023 is a path traversal vulnerability in Zephyr's HTTP server static-filesystem resource handler (HTTP_RESOURCE_TYPE_STATIC_FS) in subsys/net/lib/http when CONFIG_FILE_SYSTEM is enabled. In affected releases, the HTTP/1 and HTTP/2 front-ends store the attacker-controlled request path in client->url_buffer without canonicalizing dot segments. For HTTP/1 this path is assembled in on_url(); for HTTP/2 it is copied from the :path pseudo-header. The static-FS handler then constructs the filesystem path by directly concatenating the configured static root path with the raw URL using snprintk(..., "%s%s", static_fs_detail->fs_path, client->url_buffer) and opens the resulting path with fs_open(fname, FS_O_READ). Because resource dispatch can reach the handler through wildcard or leading-directory matching (fnmatch with FNM_LEADING_DIR) or fallback resource matching, a request containing traversal sequences such as ../ can be routed to the handler. When the underlying filesystem resolves those segments, the effective path can escape the configured web root and access files elsewhere on the mounted volume. The issue affects Zephyr releases v4.0.0 through v4.4.0 in deployments that register a static-filesystem resource.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a compact proof-of-concept for CVE-2026-8023, a pre-auth path traversal in Zephyr RTOS's HTTP server static filesystem handler when wildcard resource matching is enabled. The repo contains a README with vulnerability details and reproduction steps, a Dockerfile to build a native_sim environment, and a single Zephyr PoC application under pocs/http_static_fs_native_sim/. The main exploit logic is in src/main.c. The PoC sets up a LittleFS filesystem mounted at /littlefs, creates a web root at /littlefs/www, and deliberately stores a sensitive file at /littlefs/device.env outside that web root. It then registers a wildcard HTTP static-fs resource for /www/* while the backing filesystem path is the broader mount point /littlefs. After starting the Zephyr HTTP server on 127.0.0.1:8080, the program issues loopback requests to itself over raw TCP sockets. Exploit capability: unauthenticated arbitrary file read via directory traversal. Successful probes request /www/../device.env over HTTP/1.1 and HTTP/2 and verify that the secret payload (wifi_psk and mqtt_token values) is returned. The code also includes negative tests for percent-encoded traversal (/www/%2e%2e/device.env), confirming that the tested vulnerable path does not decode those sequences in this harness. Repository structure and purpose: - README.md: vulnerability description, affected versions, commit references, curl reproduction examples. - pocs/Dockerfile.native-sim: Ubuntu-based build container with Zephyr tooling and Python dependencies. - pocs/http_static_fs_native_sim/CMakeLists.txt: Zephyr app build definition. - pocs/http_static_fs_native_sim/prj.conf: enables networking, loopback, LittleFS, HTTP server, and wildcard resource support. - pocs/http_static_fs_native_sim/ramdisk.overlay: defines RAM disk backing storage. - pocs/http_static_fs_native_sim/sections-rom.ld: linker iterable section support for HTTP resource descriptors. - pocs/http_static_fs_native_sim/src/main.c: full exploit harness, filesystem preparation, HTTP/1.1 and HTTP/2 request generation, and validation logic. Overall, this is a real exploit PoC rather than a scanner: it creates the vulnerable condition, launches the service, and demonstrates exfiltration of a file outside the intended document root.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.