Smallsrv Small HTTP 3.06.36 http.exe unquoted search path

Summaryinfo

A vulnerability was found in Smallsrv Small HTTP 3.06.36. It has been declared as problematic. This impacts an unknown function of the file C:\Program Files (x86)\shttps_mg\http.exe. The manipulation results in unquoted search path. This vulnerability is cataloged as CVE-2025-41359. The attack must be initiated from a local position. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Smallsrv Small HTTP 3.06.36. Affected is some unknown processing of the file C:\Program Files (x86)\shttps_mg\http.exe. The manipulation with an unknown input leads to a unquoted search path vulnerability. CWE is classifying the issue as CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.

The weakness was shared by Rafael Pedrero. The advisory is shared for download at incibe.es. This vulnerability is traded as CVE-2025-41359 since 04/16/2025. The exploitability is told to be difficult. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1574.009.

Applying a patch is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Smallsrv

Name

• Small HTTP

Version

• 3.06.36

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion