The vulnerability is a classic path traversal flaw in Zephyr's HTTP server static-file resource handler that allows an unauthenticated client to read any file on the mounted filesystem if the path contains ../ segments. This flaw arises because the server concatenates the raw client URL to the rooted directory without normalizing the path before opening the file. The result is an information-disclosure vulnerability that lets remote attackers read arbitrary readable files on the device, which could include configuration or secret data. The weakness is CWE-23 (Path Traversal) and is triggered via HTTP requests sent to the device's web server.

Zephyr RTOS version 4.0.0 through 4.4.0 where the static-filesystem resource is registered and CONFIG_FILE_SYSTEM is enabled. The flaw exists in the subsys/net/lib/http module and applies to any underlying filesystem such as LittleFS or FAT.

The CVSS score of 7.5 reflects the high impact of data disclosure and the fact that the server does not require authentication or TLS to reach the vulnerable path. The EPSS score is not available, so current exploitation probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. Nevertheless, an attacker can exploit it by sending a crafted HTTP request containing traversal sequences to any Zephyr device exposing the static-file handler. The vulnerability can be triggered over the local network or internet if the device is reachable without interception. Because authentication is not required, anyone who can reach the HTTP service can read arbitrary files on the filesystem, making this a serious risk for deployments that expose sensitive information.