@hapi/inert, used for serving static files in hapi.js applications, had a flaw in its confinement mechanism in versions 4.0.0 through 7.1.0. The check that verified requested file paths against the configured base directory performed a raw string‑prefix comparison on the resolved absolute path. This allowed an attacker to reference a sibling directory outside the intended confinement area, such as /app/static-secret, and read files within it via an encoded request like "/..%2fstatic-secret/secret.txt". The result is an unauthenticated path traversal (CWE‑22) exposing sensitive files without authentication.

Any application that relies on @hapi/inert versions between 4.0.0 and 7.1.0, including both directory and file handlers as well as the h.file() relativeTo option, is vulnerable. The issue occurs when the confine option is enabled, and it can be exploited in any deployment where a sibling directory resides adjacent to the served static root. The fix is available in version 7.1.1 and later.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% shows a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by making a standard HTTP request to a path resolved under a sibling directory, without the need for authentication or elevated privileges. The nature of the attack makes it simple to perform once the service is reachable over the network.