This vulnerability allows an attacker to exploit a path normalization bypass in the Envoy proxy, using dot and dot‑dot segments combined with request parameters to reference files or directories outside the intended scope. The issue enables unauthorized reading of protected resources, consistent with path traversal weaknesses (CWE‑22). While there is no detailed description, the CVE title indicates that request paths are not properly resolved, potentially exposing sensitive data. Users who rely on Envoy’s default file handling may be able to retrieve information they should not have access to if the proxy serves files based on the supplied path.

The affected product is Envoy, the open‑source edge and service proxy. No specific version ranges are provided in the available data, so any released or deployed version of Envoy could be vulnerable until a vendor notice or patch confirms remediation. System administrators should review the Envoy version in use against the vendor’s advisories for confirmation.

The assessed CVSS score of 5.3 places the risk in a moderate category, and the vulnerability is listed as not a known exploited vulnerability in the CISA KEV database. Exploitation would likely occur over the network by crafting HTTP requests that include carefully structured dot/dot‑dot segments and parameters; the absence of EPSS data means the probability of active exploitation cannot be quantified. Attackers with network access to the Envoy instance could leverage this bypass to read ordinary files from the underlying filesystem, potentially compromising confidentiality. The impact is limited to file disclosure; there is no evidence of code execution or privilege escalation beyond unauthorized file access.