esm.sh: web.NewHandler arbitrary file read via encoded dot-segment path traversal (CVE-2026-102657)

The web.NewHandler component in esm.sh/web (versions < 0.2.0) contains a path traversal vulnerability. When a request path contains URL-encoded dot-segments (e.g., %2e%2e), Go's ServeMux fails to redirect the request, and the handler proceeds to join the decoded path with AppDir without performing a containment check. This allows unauthenticated attackers to read files located outside the intended application directory, restricted only by the filesystem permissions of the server process.

Attack Chain

1. Attacker crafts an HTTP GET request containing URL-encoded traversal segments (e.g., /%2e%2e/%2e%2e/secret.txt).
2. The network-facing http.ServeMux decodes the request path.
3. Because the segments are URL-encoded, ServeMux does not block or redirect the request.
4. The request is passed to web.NewHandler.
5. web.NewHandler joins the Config.AppDir path with the decoded r.URL.Path.
6. The application performs os.Lstat and os.Open on the resulting path, which resolves to a location outside the application directory.
7. The server reads the file content and copies it into the HTTP response body, disclosing sensitive data to the attacker.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the filesystem accessible to the application process. This may include configuration files, environment variables, source code, or private keys, depending on the server configuration and file permissions.

Recommendation

1. Upgrade esm.sh/web to version 0.2.0 or later immediately.
2. For environments where upgrading is delayed, apply input validation at the web server or proxy level to block request paths containing %2e or .. segments.
3. Ensure the web application runs with the principle of least privilege, restricting the filesystem access of the process to the absolute minimum required by AppDir.