Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
PUBLISHED5.2CWE-428
Multiple vulnerabilities in Small HTTP server by Smallsrv
Problem type
Affected products
Smallsrv
Small HTTP
3.06.36 - AFFECTED
References
JSON source
https://cveawg.mitre.org/api/cve/CVE-2025-41359Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-41359",
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"dateUpdated": "2026-03-26T13:37:41.179Z",
"dateReserved": "2025-04-16T09:57:04.871Z",
"datePublished": "2026-03-26T12:20:03.730Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE",
"dateUpdated": "2026-03-26T12:20:03.730Z"
},
"title": "Multiple vulnerabilities in Small HTTP server by Smallsrv",
"descriptions": [
{
"lang": "en",
"value": "Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\\Program Files (x86)\\shttps_mg\\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\\Program Files (x86)\\shttps_mg\\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access."
}
]
}
],
"affected": [
{
"vendor": "Smallsrv",
"product": "Small HTTP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "3.06.36",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-428 Unquoted search path or element",
"cweId": "CWE-428",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv",
"tags": [
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "The vulnerability has been fixed in version V3.06.38.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "The vulnerability has been fixed in version V3.06.38."
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rafael Pedrero",
"type": "finder"
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-03-26T13:37:41.179Z"
},
"title": "CISA ADP Vulnrichment",
"metrics": [
{}
]
}
]
}
}