CyberRota Analysis
AI-GeneratedThe serveStatic utility in h3 versions prior to 1.15.9 is vulnerable to a path traversal attack due to a double-decoding flaw that allows crafted request paths to bypass security checks. This vulnerability can lead to unauthorized access to arbitrary files stored in URL-based backends, such as CDNs or object storage services. Organizations using affected versions of h3 should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.