CVE-2026-5789
Awaiting Analysis Awaiting Analysis - Queue
Unquoted Search Path in CivetWeb v1.16 Enables Privilege Escalation

Publication date: 2026-04-21

Last updated on: 2026-04-22

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-21
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-14
NVD
CVE-2026-5789
EUVD
EUVD-2026-24138
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
civetweb_project civetweb 1.16
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-428 The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is related to an unquoted search path in CivetWeb version 1.16. Because the service configuration does not include quotes around the executable path, a local attacker can place a malicious executable in a directory that is searched before the legitimate application path. This allows the attacker to execute arbitrary code with elevated privileges.

Impact Analysis

The vulnerability can allow a local attacker to run arbitrary code with elevated privileges on the affected system. This means the attacker could potentially take control of the system, modify or delete data, install malware, or perform other malicious actions with higher access rights than normally permitted.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart