An unauthenticated path traversal vulnerability in the frustratedProton http-server enables remote attackers to access arbitrary files on the host system, posing a significant risk to data confidentiality.

The application is susceptible to a path traversal flaw (CWE-22) within the RequestHandler::handleRequest method. An unauthenticated attacker can supply crafted ../ sequences in an HTTP GET request to bypass directory restrictions and access files outside the intended web root.

Successful exploitation of this vulnerability permits unauthorized access to sensitive files residing on the server filesystem. Given the CVSS score of 7.5, this high-severity flaw could lead to the exposure of configuration files, credentials, or proprietary source code, potentially resulting in full system compromise or severe operational impact.

Immediate Action: As no patch is currently available, administrators should restrict access to the http-server instance using network-level controls or by disabling the service until a fix is released.

Proactive Monitoring: Monitor server access logs for HTTP GET requests containing directory traversal sequences, such as multiple instances of ../ or encoded path characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block incoming requests containing directory traversal patterns before they reach the server application.

Public Exploit Available: Unknown.

Due to the lack of an available patch, organizations currently utilizing frustratedProton http-server version 1.0 or lower should prioritize the implementation of strict network access controls or move the service to a protected network segment. Continuous monitoring for malicious traffic patterns is essential until an official vendor update is applied to remediate the underlying code deficiency.