CVE-2025-41368

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.

Score

CVSS 4.0 8.7 High

Status

Analyzed - cve-coordination@incibe.es

Published

2026-03-26

Last modified

2026-03-26

Weaknesses

CWE-22

Affected products

• Small Http (Smallsrv)
• Small Http Server (Smallsrv)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv