CVE-2025-41368 is an authenticated path traversal vulnerability affecting Small HTTP Server v3.06.36. This flaw allows a remote, authenticated user to bypass security restrictions and access arbitrary files outside the server's document root. Rated with a CVSSv3.1 score of 8.1 (High), the vulnerability has a low attack complexity and requires low privileges, potentially leading to high confidentiality and integrity impacts through unauthorized file disclosure and modification. Despite its high severity, there is currently no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB, and community discussion remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.06.36, < 3.06.38CPE matchmatch criteria | cpe:2.3:a:smallsrv:small_http_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.