The RabbitMQ management plugin static file handler (rabbit_mgmt_wm_static) in versions before 4.1.11 and 4.2.6 on Windows improperly handles URL-encoded backslashes by passing them to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled. This flaw allows an attacker to induce outbound DNS and SMB requests to attacker-controlled UNC paths, potentially leaking information or enabling further attacks. The vulnerability is resolved in RabbitMQ versions 4.1.11 and 4.2.6.

This vulnerability can lead to outbound network requests (DNS and SMB) to attacker-controlled UNC paths, which may result in information disclosure or facilitate further attacks. The confidentiality impact is high, integrity impact is low, and availability is not affected, as indicated by the CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N.

A fix is available in RabbitMQ versions 4.1.11 and 4.2.6. Users should upgrade affected RabbitMQ installations on Windows to these versions or later to remediate the vulnerability. No other mitigation guidance is provided or required.