WebP Server Go versions prior to 0.15.0 contain a path traversal flaw on Windows that allows unauthenticated attackers to read arbitrary files outside the configured image directory. The vulnerability stems from the server’s path handling, which accepts percent‑encoded backslashes (%5C) and does not correctly normalize them against Windows file system APIs that treat backslashes and forward slashes identically. As a result, attackers can bypass the path.Clean() sanitization in handler/router.go and retrieve sensitive files accessible to the server process. The flaw provides a high‑severity risk to confidentiality, with a CVSS score of 8.7.

Vendors: webp-sh, Product: webp_server_go. Affected versions: all releases older than 0.15.0, notably 0.14.4 and earlier. The vulnerability is tied to Windows deployments where the IMG_PATH setting is used to store image resources.

The flaw is highly exploitable because it requires only an unauthenticated HTTP request containing a specially crafted URL. While the EPSS score is not available, the lack of mitigation and the broad access to files elevate the risk. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS score indicates significant potential impact. Attackers can exploit the path discrepancy by sending requests with homographs of backslashes to traverse directories and read any host files the web server process can access.