This vulnerability involves a logic flaw in the HTTP server of TP-Link Tapo C260 v1 and related models where path normalization is performed before fully decoding URL encoded input. If normalization fails, the server uses the raw path, enabling attackers to supply crafted URL encoded traversal sequences that bypass directory restrictions. This allows access to files outside the intended web root directory. Authenticated attackers can access sensitive system files and credentials, whereas unauthenticated attackers can access non-sensitive static assets. The CVSS 4.0 vector indicates an attack vector requiring adjacent network access with low complexity and no user interaction, and privileges required are low.

Successful exploitation allows disclosure of sensitive system files and credentials for authenticated users, and access to non-sensitive static assets for unauthenticated users. This could lead to information leakage and potential further compromise depending on the sensitivity of the disclosed files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict network access to the affected devices to trusted users only, especially limiting access to the HTTP server interface. Monitor vendor communications for updates on remediation.