Vulnerability · Published Mar 26, 2026 · Assigned by INCIBE
CVE-2025-41359Multiple vulnerabilities in Small HTTP server by Smallsrv
High 8.5
In plain English
A high-severity security flaw in Small HTTP from Smallsrv. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Smallsrv | Small HTTP | 3.06.36 |
Weakness: CWE-428 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N