The vulnerability involves a directory traversal flaw that can be triggered by supplying a crafted HTTP request. The flaw allows an attacker to retrieve files outside the intended web root, potentially exposing sensitive configuration data or other secrets stored on the server. Because the attacker can read arbitrary files, there is a risk of information leakage that may facilitate further attacks such as privilege escalation or data exfiltration.

The affected product is the Go HTTP server implementation (gohttp) at commit 34ea51. No version ranges or vendor products are listed, so any deployment using this exact code commit is potentially impacted.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation in the wild to date. The attack vector is inferred to be remote over the network, as the flaw is triggered via an HTTP request. The CVSS score of 7.3 indicates a medium to high severity, highlighting the potential for significant impact if the vulnerability is exploited.