CVE-2022-28380: Rc-Httpd Project Rc-Httpd

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.

Affected products

• Rc-Httpd Project Rc-Httpd: up to and including 2022-03-31

Published 2022-04-03. Last modified 2026-06-17.