The vulnerability exists in the web.NewHandler static file server of esm.sh. The handler concatenates the request path with the configured application directory without ensuring that the resulting path remains under that directory. URL‐encoded dot segments such as %2e%2e bypass Go’s internal redirection checks, allowing an attacker to craft a request that resolves to arbitrary files on the server. The sole confirmed impact is the disclosure of files readable by the server process; there is no privilege escalation or code execution. This flaw is associated with CWE‑22.

The issue affects all esm.sh server releases before version 137_7. Any instance of the CDN running an older server is vulnerable, regardless of the deployment environment, and the vulnerability can be exploited even when developer mode is disabled. The affected product is esm.sh delivered by esm-dev.

The CVSS score of 7.5 places the flaw in the high severity range, and while the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated remote attacker can trigger the flaw by sending a specially crafted HTTP request to the static file server; because the redirect logic is bypassed, no prior authentication is needed. The risk is significant for publicly exposed instances, as attackers can read arbitrary configuration, source code, or other sensitive files that the web server can access.