The vulnerability arises because webpack-dev-middleware's pathname traversal guard only matches ".." as a whole path segment and slices the pathname at a fixed offset based on the publicPath length. When publicPath lacks a trailing slash, crafted requests like GET /assets../.env can bypass the guard, resulting in path.join resolving to a directory above the intended outputPath. This allows reading files outside the restricted directory if the middleware uses the physical filesystem backing (e.g., writeToDisk=true). The traversal depth is limited to one directory due to URL parsing collapsing dot-dot segments. This vulnerability is present in versions from 5.3.4, 6.1.2, and 7.1.0 onward and represents an incomplete fix of CVE-2024-29180.

An attacker can read files outside the intended directory served by webpack-dev-middleware if the middleware is configured to write to disk or uses a custom outputFileSystem backed by the physical filesystem. This can lead to unauthorized disclosure of sensitive files on the server. The vulnerability does not allow code execution or privilege escalation but poses a high confidentiality impact due to potential exposure of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid configuring webpack-dev-middleware with a publicPath that lacks a trailing slash and avoid enabling writeToDisk or using a physical filesystem backing if possible. Monitor vendor advisories for updates and apply official patches once released.