The vulnerability is a Path Traversal flaw in the wisp.serve_static handler. The code performs string replacement before percent-decoding, so an encoded '..' (for example, %2e%2e) passes through unchanged and is decoded to .., allowing the operating system to interpret it as a directory traversal. This flaw allows an unauthenticated attacker to read any file that the application process can access in a single HTTP request, including source code, configuration files, secrets, and system files.

Affected products are the Gleam‑Wisp wisp web framework for all versions from 2.1.1 up to, but not including, 2.2.1. Applications built with these versions that use the default serve_static component are vulnerable.

The CVSS base score is 8.7, indicating a high severity risk. The EPSS score is below 1%, suggesting a low probability of exploitation observed in the wild at the time of publication. The vulnerability is not listed in the CISA KEV catalog, so no proof of exploitation is publicly known. The flaw can be exploited remotely over HTTP with no authentication; an attacker can target any readable file in the application’s scope by crafting an HTTP request containing a percent‑encoded traversal sequence. Because access is based on the privileges of the application process, the compromise can be more extensive in deployments where the process runs with elevated rights.