CVE-2026-54286 is a path traversal vulnerability in the honojs hono framework affecting versions before 4.12.25 on Windows systems. The issue arises because an encoded backslash (%5C) in the URL path decodes to a backslash (\), which the Windows path resolver interprets as a directory separator. This causes serve-static middleware to resolve a single URL segment like 'admin\secret.txt' into a nested file path under the root directory, allowing unauthorized reading of static files protected by prefix-mounted middleware. The vulnerability is addressed in hono version 4.12.25.

An attacker can read static files that are intended to be protected behind middleware by exploiting the path traversal flaw on Windows hosts. This leads to unauthorized disclosure of potentially sensitive files. The CVSS score is 5.9 (medium severity), reflecting network attack vector with high impact on confidentiality but no impact on integrity or availability.

Upgrade hono to version 4.12.25 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required according to the available data.