Small HTTP vulnerabilities

2 known vulnerabilities in Small HTTP from Smallsrv. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Small HTTP: Unquoted Search Path or Element

  CVE-2025-41359Mar 26, 2026Smallsrv

  Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable

• 8.1 High severity

  Small HTTP: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-41368Mar 26, 2026Smallsrv

  Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the documen