CVE-2025-41368 - Vulnerability Analysis

Overview

Small HTTP Server 3.06.36 contains an unquoted service path vulnerability caused by improper quoting of the executable path, letting local attackers execute arbitrary code by placing malicious executables in higher priority directories, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code, leading to unauthorized system access or service disruption.

Mitigation

Properly quote the service path and apply the latest security patches.

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner