CVE-2025-41368 - Vulnerability Analysis

Overview

Small HTTP Server 3.06.36 contains an unquoted service path vulnerability caused by improper quoting of the executable path, letting local attackers execute arbitrary code by placing malicious executables in higher priority directories, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code, leading to unauthorized system access or service disruption.

Mitigation

Properly quote the service path and apply the latest security patches.

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🟠 CVE-2025-41368 - High (8.1) Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outsid... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41368/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner