Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-67185

TinyWeb 0.0.8 Path Traversal via URL Path Component

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

GeneralSandman TinyWeb

Default version status: affected

  • 0b3b5fdb5a058f50248cd8547824936b8dd10351 to ≤ a381da252fe8e873c8aff22703040426cc9b2ae0affected
  • 0.0.8affected
pkg:github/GeneralSandman/TinyWeb

References