Unquoted Search Path in CivetWeb v1.16 Enables Privilege Escalation

Publication date: 2026-04-21

Last updated on: 2026-04-22

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-21

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-22

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5789

EUVD

EUVD-2026-24138

Affected Vendors & Products

Vendor	Product	Version / Range
civetweb_project	civetweb	1.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-428	The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Attack-Flow Graph

Executive Summary

This vulnerability is related to an unquoted search path in CivetWeb version 1.16. Because the service configuration does not include quotes around the executable path, a local attacker can place a malicious executable in a directory that is searched before the legitimate application path. This allows the attacker to execute arbitrary code with elevated privileges.

Impact Analysis

The vulnerability can allow a local attacker to run arbitrary code with elevated privileges on the affected system. This means the attacker could potentially take control of the system, modify or delete data, install malware, or perform other malicious actions with higher access rights than normally permitted.

Hi! I’m here to help you understand CVE-2026-5789. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70