CVE-2026-67185 Details
Description
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root.
A path traversal vulnerability has been identified in TinyWeb versions through 0.0.8. This vulnerability allows unauthenticated attackers to read arbitrary files by inserting '../' sequences into the URL path. The server concatenates these sequences directly to the configured web root without proper normalization or boundary checks. As a result, attackers can craft a request that bypasses the URL parser's restrictions and reaches the filesystem, potentially exposing sensitive files such as credential stores and private keys, especially when the server runs as root.
To address this vulnerability, canonicalize the file path using 'realpath()' and ensure it remains within the web root before serving the file. Additionally, remove dot-segments during URL parsing according to RFC 3986 guidelines, and percent-decode the path before normalization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TinyWeb | >= 0b3b5fd, <= a381da2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |