A flaw was found in BusyBox's httpd. When FEATURE_HTTPD_GZIP is enabled and a request for /FILE includes an Accept-Encoding: gzip header, httpd serves the pre-compressed FILE.gz if it exists, but authentication rules are matched against the request path only. As a result, a password rule configured for /secret.txt.gz can be bypassed by requesting /secret.txt with Accept-Encoding: gzip, disclosing the contents of the protected file. Only rules naming a specific .gz file are affected; directory rules cover both names.