CVE-2007-6404

CVE-2007-6404 describes a directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) version 1.38 and earlier, specifically impacting Windows environments. This flaw allows unauthenticated remote attackers to read arbitrary files by injecting a "..\" sequence into the URI. While the CVSS score is a moderate 5.0, indicating low attack complexity and no authentication required, its FAUCET Risk Score of 86/100 suggests a higher practical risk. Although there is no evidence of active exploitation or Metasploit modules, an exploit is available on ExploitDB, and it has a higher EPSS score than 0.93% of all CVEs, indicating some potential for exploitation despite minimal community discussion or media coverage.