The vulnerability allows an attacker to read arbitrary files on the host where the webpack-dev-middleware is running. It is a path traversal flaw triggered by requests that do not terminate the configured publicPath with a slash. The flaw originates from a guard that only blocks whole‑segment ".." patterns, while the offset slice used to construct the file path cuts into the untrusted segment. When the guard passes, the relative path is joined with the output directory, allowing the file system to resolve a directory one level above the intended build directory. The weakness is CWE‑22, exposing integrity and confidentiality of files without proper filters.

Affected products are webpack’s webpack-dev-middleware, in all releases from 5.3.4 onward. The issue surfaces when the configured publicPath has no trailing slash and the middleware is backed by a physical file system – for example when writeToDisk is true or a custom outputFileSystem is supplied. The default publicPath value of "auto" resolves to "/" and is not affected, but any non‑trailing‑slash publicPath such as "/assets" can be abused.

The CVSS score of 8.3 indicates high severity, while the EPSS score is not available, so a precise probability cannot be stated. The vulnerability is not listed in CISA KEV. The likely attack vector is an HTTP GET request to the development server’s asset endpoint; the attacker merely needs network access to the dev server. Because the directory traversal is limited to a single level and requires that the middleware writes to or reads from disk, the risk is lower than a full system compromise but still enables reading sensitive files such as configuration or environment files. Since the bug can be triggered by a simple crafted URL, exploitation is straightforward for an attacker who can reach the dev server.