The vulnerability allows an attacker to bypass authentication filters when accessing static files served from a case‑insensitive filesystem, such as the default macOS setup. If the application delivers static content and the filesystem treats uppercase and lowercase file names as equivalent, an attacker can change the case of the file name in the HTTP request to circumvent the configured filters that only detect lower‑case names. This leads to unauthorized access to protected static resources rather than the entire application, but it still allows leakage of potentially sensitive data.

All releases of Apache Shiro prior to 2.0.7 are affected. The issue is addressed in 2.0.7, which introduces a new parameter in shiro.ini or application.properties that enables case‑insensitive filter resolution when true. Future versions 3.0.0 and later make this behaviour the default.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via HTTP requests by altering the case of a static file name; no special privileges or local access are required. Given the moderate score but low likelihood of exploitation, the overall risk remains moderate, but patching is recommended to eliminate the possibility of unauthorized static content exposure.