CVE-2026-69201

The static content handlers `ResourceService` and `WebjarService` URL decode each path segment and then reject only segments that are exactly `""`, `"."`, or `".."`. A percent-encoded separator (`%2F`) lets an attacker smuggle a `../` segment past that filter and escape the configured base, reading resources that should not be public. On Windows, a similar attack exists with (`%5C`). ## Impact Disclosure of classpath or webjar resources outside the configured base. ## Preconditions - Application uses `ResourceService` (with a non-root base path) or `WebjarService` - At least one classpath entry is served from a directory (e.g. `sbt run`, exploded .war) - Backend forwards `%2F`/`%5C` without normalizing (e.g., Ember, Blaze) ## Fixes The patch rejects any decoded path segment containing `/` (`%2F`) or `\` (`%5C`) with a `400 Bad Request` in `ResourceService` and `WebjarService`. `FileService` was not exploitable, but the same guards are applied for consistency and to remove its reliance on path normalization. ## Workarounds - Deploy as a fat jar, with no filesystem directories on the classpath. - Front the service with a proxy that rejects/normalizes `%2F` and `%5C` in the request path.