CVE-2025-41359
Unquoted Service Path in Small HTTP Server Enables Code Execution
Publication date: 2026-03-26
Last updated on: 2026-03-26
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smallsrv | small_http_server | From 3.06.36 (inc) to 3.06.38 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to arbitrary code execution, which means an attacker could run malicious programs on your system with the privileges of the affected service.
This could result in unauthorized access to your system, allowing the attacker to steal data, modify system settings, or disrupt the normal operation of the service.
Additionally, service disruption could affect availability and reliability of the affected application.
Can you explain this vulnerability to me?
This vulnerability is related to an unquoted service path in Small HTTP Server version 3.06.36. Specifically, the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service' is affected. Because the service path is not properly quoted, a local attacker can place a malicious executable with the same name in a directory that has higher priority in the system's search order. When the service starts, it may execute the malicious file instead of the legitimate one.
This misconfiguration allows the attacker to execute arbitrary code on the system, gain unauthorized access, or disrupt the service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to an unquoted service path in Small HTTP Server 3.06.36, specifically the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. Detection involves checking if the service path is unquoted, which allows a local attacker to place a malicious executable in a higher priority directory.
To detect this on your system, you can check the service path for unquoted spaces. For example, on Windows, you can use the following command to list services and their paths:
- sc qc <service_name>
Replace <service_name> with the actual service name related to Small HTTP Server. If the path shown is unquoted and contains spaces, it is vulnerable.
Alternatively, you can use PowerShell to find unquoted service paths with commands like:
- Get-WmiObject win32_service | Where-Object { $_.PathName -match ' ' -and $_.PathName -notmatch '"' } | Select-Object Name, PathName
This command lists services with unquoted paths containing spaces, which may indicate vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include properly quoting the service path to prevent execution of malicious executables placed in higher priority directories.
Additionally, keep the system and the Small HTTP Server software up to date with the latest security patches.
Restrict physical and network access to the affected system to reduce the risk of local attackers exploiting this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows arbitrary code execution, unauthorized access to the system, or service disruption due to an unquoted service path in Small HTTP Server 3.06.36. Such security weaknesses can lead to data breaches or unauthorized data access, which may impact compliance with standards and regulations like GDPR or HIPAA that require protection of sensitive data and system integrity.
To maintain compliance, it is critical to mitigate this vulnerability by properly quoting the service path, applying security patches, and restricting physical and network access to prevent exploitation.