This vulnerability involves a logic flaw in the HTTP server of TP-Link Tapo devices where path normalization is performed before fully decoding URL encoded input. If normalization fails, the server falls back to using the raw path, enabling attackers to supply crafted URL encoded traversal sequences that bypass directory restrictions. This allows access to files outside the intended web root directory. Authenticated attackers may disclose sensitive system files and credentials, whereas unauthenticated attackers can access non-sensitive static assets. The affected products include Tapo C260 v1, D235 v1, C211 v2, and C520WS v2.6.

Successful exploitation can lead to disclosure of sensitive system files and credentials by authenticated attackers. Unauthenticated attackers may gain access to non-sensitive static assets. This could potentially aid further attacks or information gathering but does not directly indicate remote code execution or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the affected devices to trusted networks and authenticated users where possible.