Attack Chain

1. Attacker crafts an HTTP GET request containing URL-encoded traversal segments (e.g., /%2e%2e/%2e%2e/secret.txt).
2. The network-facing http.ServeMux decodes the request path.
3. Because the segments are URL-encoded, ServeMux does not block or redirect the request.
4. The request is passed to web.NewHandler.
5. web.NewHandler joins the Config.AppDir path with the decoded r.URL.Path.
6. The application performs os.Lstat and os.Open on the resulting path, which resolves to a location outside the application directory.
7. The server reads the file content and copies it into the HTTP response body, disclosing sensitive data to the attacker.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files on the filesystem accessible to the application process. This may include configuration files, environment variables, source code, or private keys, depending on the server configuration and file permissions.

Recommendation

1. Upgrade esm.sh/web to version 0.2.0 or later immediately.
2. For environments where upgrading is delayed, apply input validation at the web server or proxy level to block request paths containing %2e or .. segments.
3. Ensure the web application runs with the principle of least privilege, restricting the filesystem access of the process to the absolute minimum required by AppDir.