A path traversal flaw in TP‑Link Tapo devices’ HTTP server causes the server to normalize URLs before fully decoding them and, when normalization fails, fall back to the raw path. This logic allows an attacker to send URL‑encoded traversal sequences that bypass directory restrictions and read files outside the web root, including sensitive system files and credentials. The vulnerability results in confidential data disclosure and potential credential compromise for authenticated users, while unauthenticated users can access non‑sensitive static assets.

Vendors and product models affected are TP‑Link Systems Inc., specifically the Tapo C260 v1, D235 v1, and C520WS v2.6. No other firmware versions are listed as vulnerable, and the issue appears limited to the current official releases referenced in the vendor’s support links.

With a CVSS score of 6.9 the vulnerability is considered moderate. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack scenario involves an attacker with local network access who can reach the device’s HTTPS interface; the attacker could supply crafted URL‑encoded traversal sequences that bypass directory restrictions and read files outside the web root. If the device is authenticated, the attacker can obtain sensitive files, but even unauthenticated users may read publicly served assets. Because the flaw is purely logical and does not require exploitation of a separate service, its impact is confined to the device and the local network, making it a localized but potentially damaging threat.