CVE-2026-82481: CWE-180 Incorrect Behavior Order: Validate Before Canonicalize in mirage cohttp

The cohttp package before version 6.3.0 for OCaml contains a directory traversal vulnerability due to improper ordering of validation and canonicalization steps (CWE-180). This vulnerability allows an attacker to bypass intended access controls by exploiting the incorrect sequence of input validation, potentially accessing files or directories outside the intended scope. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and availability. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform directory traversal attacks, potentially accessing sensitive files or data outside the intended directory structure. This impacts confidentiality and availability of the affected system. The vulnerability is exploitable remotely without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying manual mitigations such as input sanitization or restricting access controls where possible. Monitor official mirage project channels for updates.