C++ HTTP Server accepts HTTP/1.1 requests and serves files from a configured directory. A flaw in RequestHandler::handleRequest fails to sanitize the filename derived from the URL path, allowing a malicious client to craft a GET request containing "../" sequences. The vulnerability is a classic directory traversal (CWE-22) that permits an unauthenticated, remote attacker to read any file on the server’s filesystem beyond the intended root, potentially exposing configuration files, credentials, or sensitive data. The impact is confidentiality compromise by remote arbitrary file read.

The problem affects the open‑source http‑server project from frustratedProton, specifically all releases version 1.0 and earlier. Any deployment of these versions exposing the HTTP interface is vulnerable until a patch or mitigative change is applied.

The CVSS base score of 7.5 reflects high impact and medium exploitation difficulty; the EPSS score of less than 1% suggests that, at the moment, exploitation attempts are rare, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker can trigger the flaw remotely without authentication by sending a crafted GET request that includes path‑traversal sequences. Success hinges on the server running an affected version and the network being accessible, so perimeter defenses and IP restrictions reduce the attack surface.