CVE-2026-28807

@@ -6,6 +6,10 @@
   package. A `wisp_ewe` package has been created too!
 - `send_file` failing will now result in an internal server error being sent.
 
+## v2.2.1 - 2026-03-08
+
+- Fixed a path traversal attack with encoded URI paths in `serve_static`.
+
 ## v2.2.0 - 2026-01-16
 
 - The `content_security_policy_protection` middleware has been added.

@@ -1,5 +1,5 @@
 name = "wisp"
-version = "2.2.0"
+version = "2.2.1"
 gleam = ">= 1.11.0"
 description = "A practical web framework for Gleam"
 licences = ["Apache-2.0"]

@@ -1423,14 +1423,11 @@ pub fn serve_static(
       let path =
         path
         |> string.drop_start(string.length(prefix))
+        |> uri.percent_decode
+        |> result.unwrap(path)
         |> string.replace(each: "..", with: "")
         |> filepath.join(directory, _)
 
-      let path = case uri.percent_decode(path) {
-        Ok(p) -> p
-        Error(_) -> path
-      }
-
       let file_type =
         req.path
         |> string.split(on: ".")

@@ -503,20 +503,33 @@ pub fn serve_static_not_found_test() {
     |> request.set_path("/stuff/credit_card_details.txt")
   assert {
       use <- wisp.serve_static(request, under: "/stuff", from: "./")
-      wisp.ok()
+      wisp.not_found()
     }
-    == wisp.ok()
+    == wisp.not_found()
 }
 
-pub fn serve_static_go_up_test() {
+pub fn serve_static_path_traversal_attack_test() {
   let request =
     simulate.request(http.Get, "/")
-    |> request.set_path("/../test/fixture.txt")
-  assert {
-      use <- wisp.serve_static(request, under: "/stuff", from: "./src/")
-      wisp.ok()
-    }
-    == wisp.ok()
+    |> request.set_path("/../gleam.toml")
+  let response = {
+    use <- wisp.serve_static(request, under: "/", from: "./src/")
+    wisp.not_found()
+  }
+  assert response == wisp.not_found()
+    as "the file should not be returned as the .. segment should be discarded to prevent path traversals"
+}
+
+pub fn serve_static_path_traversal_attack_uri_encoded_test() {
+  let request =
+    simulate.request(http.Get, "/")
+    |> request.set_path("/%2e%2e/gleam.toml")
+  let response = {
+    use <- wisp.serve_static(request, under: "/", from: "./src/")
+    wisp.not_found()
+  }
+  assert response == wisp.not_found()
+    as "the file should not be returned as the .. segment should be discarded to prevent path traversals"
 }
 
 pub fn serve_static_etags_returns_304_test() {

@@ -1425,6 +1425,11 @@ pub fn serve_static(
         |> string.drop_start(string.length(prefix))
         |> string.replace(each: "..", with: "")
         |> filepath.join(directory, _)
+      
+      let path = case uri.percent_decode(path) {
+        Ok(p) -> p
+        Error(_) -> path
+      }
 
       let file_type =
         req.path