Honojs hono, a JavaScript web application framework, suffers from a path traversal vulnerability on Windows platforms in versions before 4.12.25. The vulnerability arises because an encoded backslash (%5C) in the URL path is decoded to a backslash (\), which the Windows path resolver interprets as a directory separator. This behavior enables the serve-static middleware to resolve crafted URL segments like 'admin\secret.txt' as nested files under the root directory, bypassing prefix-mounted middleware protections. This can lead to unauthorized disclosure of static files that should be protected. The vulnerability is addressed and fixed in version 4.12.25.

An attacker can exploit this vulnerability to read static files that are intended to be protected behind middleware restrictions. This unauthorized file access can lead to information disclosure. The CVSS score is 5.9 (medium severity), indicating a moderate impact primarily on confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade to hono version 4.12.25 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is included in 4.12.25.