Zephyr's HTTP server static-filesystem resource type improperly handles attacker-controlled request paths by concatenating raw URL paths containing ../ segments directly with the configured root directory without resolving or canonicalizing these segments. This allows path traversal, enabling remote unauthenticated clients to read arbitrary files on the mounted filesystem. The issue affects HTTP/1 and HTTP/2 front-ends prior to the fix. The vulnerability impacts Zephyr versions from 4.0.0 up to but not including 4.5.0 when the static-filesystem resource is used. The fix adds a function to remove dot segments from the URL path before file lookup, preventing traversal.

An unauthenticated remote attacker can exploit this vulnerability to read arbitrary readable files on the mounted volume outside the intended web root directory. This leads to information disclosure with a high confidentiality impact. There is no impact on integrity or availability. The vulnerability does not require user interaction or authentication and can be triggered over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has introduced a fix that canonicalizes URL paths to prevent path traversal. Users should monitor the official Zephyr project advisories for patches or updates addressing this issue. Until a fix is applied, avoid enabling the static-filesystem resource or restrict access to trusted networks if possible.