CVE-2025-41368
Unquoted Service Path in Small HTTP Server Enables Code Execution
Publication date: 2026-03-26
Last updated on: 2026-03-26
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| smallsrv | small_http_server | From 3.06.36 (inc) to 3.06.38 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an unquoted service path in Small HTTP Server version 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. Because the service path is not properly quoted, a local attacker can place a malicious executable with the same name in a directory that has higher priority in the system's search order. When the service starts, it may execute the malicious file instead of the legitimate one.
This misconfiguration allows the attacker to execute arbitrary code, gain unauthorized access to the system, or disrupt the service.
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to arbitrary code execution on the affected system, which means an attacker could run malicious programs with the privileges of the service.
This can result in unauthorized access to sensitive system resources or data, as well as disruption or denial of service by interfering with the normal operation of the Small HTTP Server.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an unquoted service path for the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. Detection involves checking the service path configuration for unquoted spaces which can be exploited.
On a Windows system, you can use the following command to check the service path for unquoted spaces:
- sc qc "ServiceName"
Replace "ServiceName" with the actual service name related to Small HTTP Server. Look for paths with spaces that are not enclosed in quotes.
Alternatively, you can use PowerShell to find all services with unquoted paths containing spaces:
- Get-WmiObject win32_service | where { $_.PathName -like '* *' -and $_.PathName -notlike '"*"*' } | select Name, PathName
This command lists services whose executable paths contain spaces but are not quoted, which indicates vulnerability to this issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include properly quoting the service path to prevent execution of malicious executables placed in higher priority directories.
Ensure that the service executable path is enclosed in double quotes, for example:
- "C:\Program Files (x86)\shttps_mg\http.exe service"
Additionally, apply the latest security patches by upgrading Small HTTP Server to version 3.06.38 or later, where this vulnerability has been resolved.
Restrict physical and network access to the affected systems to reduce the risk of local exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated remote users to bypass SecurityManager restrictions and access any file outside the configured document root. This unauthorized file access could lead to exposure of sensitive or protected data.
Such unauthorized access and potential data exposure may impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Organizations using the affected Small HTTP Server version 3.06.36 should apply the fixed version 3.06.38 to mitigate this risk and maintain compliance with data protection requirements.