The vulnerability in gleam-wisp wisp (versions 2.1.1 up to but not including 2.2.1) is due to improper limitation of pathnames in the wisp.serve_static function. Sanitization is applied before percent-decoding, allowing percent-encoded path traversal sequences (%2e%2e) to evade the sanitization step. After decoding, these sequences become '..', which the operating system interprets as directory traversal, enabling an attacker to read arbitrary files that the application process can access. This flaw can be exploited without authentication via a crafted HTTP request, potentially exposing sensitive application and system files.

An unauthenticated attacker can read any file accessible by the application process, including sensitive files such as application source code, configuration files, secrets, and system files. This exposure can lead to information disclosure that may facilitate further attacks or compromise the confidentiality of the system and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is provided in the available data, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing access controls or filtering at the web server or application gateway level to block suspicious path traversal patterns, especially percent-encoded sequences. Avoid exposing the vulnerable wisp.serve_static functionality to untrusted users if possible.