The flaw lies in the encode_url_path function of the salvo-proxy component, which fails to normalize "../" sequences and does not re‑encode the "." character, allowing crafted URLs to be forwarded unchanged to the upstream server. An unauthenticated external attacker can exploit this to bypass proxy routing constraints, reaching protected backend paths such as administrative dashboards or other sensitive endpoints. The vulnerability carries a CVSS score of 7.5, indicating a high degree of severity due to the potential for unauthorized access.

The affected product is the Salvo Rust web framework provided by salvo-rs. Versions ranging from 0.39.0 up to and including 0.89.2 are impacted. Version 0.89.3 contains a fix for the issue.

The EPSS score indicates a very low probability of exploitation (<1%), and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale, pre‑employed attacks are not yet widespread. Nevertheless, the CVSS score and the nature of the flaw mean that an attacker who can send crafted requests to the proxy can gain unauthorized access to backend services. The exploit path does not require authentication or special permissions; it relies solely on manipulating the URL path passed to the proxy component.