Envoy’s URL normalisation logic fails to collapse path segments containing semicolon parameters when the segment is a dot or dot‑dot. A crafted request such as /user/..;foo=bar/admin is therefore left unchanged and still passed through routing or RBAC decisions that expect /admin. Because an upstream server or service may correctly interpret the semicolon‑prefixed segment according to RFC 3986, the discrepancy allows an attacker to fool Envoy into applying a bypassed authorization rule or routing decision, effectively granting access to resources that should be protected by path‑based controls.

The vulnerable product is Envoy, the open‑source edge and service proxy from envoyproxy. The issue affects all releases older than 1.36.10, 1.37.6, 1.38.4, and 1.39.1; any earlier version is potentially exploitable until it is upgraded to a fixed release.

The CVSS score of 5.3 labels the risk as moderate. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an external client that can send HTTP requests to the Envoy instance; this inference is based on the description of a remote client creating a path that confuses Envoy. An attacker who can reach the proxy can thus bypass path‑based security controls, potentially accessing otherwise protected resources. There is no evidence that the flaw can directly lead to code execution or privilege escalation beyond the scope of the path bypass.