OSEC-2026-28

Dashboard / Vulnerabilities / OSEC-2026-28

OSEC-2026-28

Summary: Unauthenticated arbitrary file read via path traversal in `/conferences/ocaml/**`

Details: `GET /conferences/ocaml/<path>` on ocaml.org concatenates the raw request target onto `OCAMLORG_V2_PATH` (`/v2`) and serves it with `Dream.from_filesystem`, bypassing the path validation that `Dream.static` performs. An unauthenticated request containing `..` segments escapes `/v2` and reads arbitrary files as the server process, which runs as `root` in the container. Please note that the live deployment of https://ocaml.org is in a dedicated Docker container which does not contain any secrets. Thus the vulnerability is in the ocaml.org source code, but there has been no impact for the live deployment. ## Affected code `src/ocamlorg_web/lib/handler.ml:1544 (commit ocaml/ocaml.org@31249f2d69fcb243284d3a6a2b91c0a4963f25b5)`: ```ocaml let v2_asset req = let</>? path = try Some (Config.v2_path ^ Dream.target req) with _ -> None in let</>? () = if Sys.file_exists path then Some () else None in Filename.(Dream.from_filesystem (dirname path) (basename path) req) ``` The route is public (`src/ocamlorg_web/lib/router.ml:186`): ```ocaml Dream.get "/conferences/ocaml/**" Handler.v2_asset; ``` `Config.v2_path` is `OCAMLORG_V2_PATH`, set to `/v2` in the production image (`Dockerfile:68`). `Dream.target` is the request target as received; nothing rejects `.` or `..` components. ## Timeline - 2026-10-31 report via https://github.com/ocaml/security-advisories - 2026-11-02 fixed via https://github.com/ocaml/ocaml.org/pull/3942 and deployed ocaml.org

References: