Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-67185TinyWeb 0.0.8 Path Traversal via URL Path Component

High 7.5

In plain English

A high-severity path traversal in TinyWeb from GeneralSandman. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root.

Affected products (as reported)

Vendor	Product	Versions
GeneralSandman	TinyWeb	0b3b5fdb5a058f50248cd8547824936b8dd10351 – through a381da252fe8e873c8aff22703040426cc9b2ae00.0.8

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/tinyweb-path-traversal-via-url-path-component third-party-advisory