Zephyr's HTTP server offers a static-filesystem resource that serves files from a configured root directory. Before the fix, both the HTTP/1 and HTTP/2 front-ends inserted the raw, attacker-controlled request path directly into the client’s URL buffer without resolving "." or ".." segments. The static-FS handler then concatenated this raw path to the root directory and opened the resulting file. Because the handler can be reached via wildcard or fallback pattern matching, a crafted request such as GET /<prefix>/../../<file> is dispatched to the handler. After the underlying filesystem resolves the ".." segments, the path escapes the intended web root, allowing an unauthenticated remote client to read arbitrary readable files on the mounted volume. The HTTP server requires no TLS or authentication to reach this path. The bug affects releases v4.0.0 through v4.4.0 for deployments that register a static-filesystem resource.

Zephyr RTOS version 4.0.0 through 4.4.0 where the static-filesystem resource is registered and CONFIG_FILE_SYSTEM is enabled. The flaw exists in the subsys/net/lib/http module and applies to any underlying filesystem such as LittleFS or FAT.

The CVSS score of 7.5 reflects the high impact of data disclosure and the fact that the server does not require authentication or TLS to reach the vulnerable path. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. Nevertheless, an attacker can exploit it by sending a crafted HTTP request containing traversal sequences to any Zephyr device exposing the static-file handler. The vulnerability can be triggered over the local network or internet if the device is reachable without interception. Because authentication is not required, anyone who can reach the HTTP service can read arbitrary files on the filesystem, making this a serious risk for deployments that expose sensitive information.