Small Http Server
Approved changes feed: RSS · Atom
cpe:2.3:a:smallsrv:small_http_server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Smallsrv (0d4c77fe-e316-5b4b-8b19-6a5d8632b7d5) |
|---|---|
| Product | Small Http Server (0605ec8b-224d-52f9-a429-63bcc44a3941) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/maxfeoktistov/smallsrv |
purl2cpe | 2026-06-01 10:17:04.462406 |
pkg:sourceforge/smallsrv |
purl2cpe | 2026-06-01 10:17:04.462408 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-41368 |
vulnerable | 2026-06-08 07:25:06.904930 |
Multiple vulnerabilities in Small HTTP server by Smallsrv
Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.
Published: 2026-03-26T11:37:52.747Z
Updated: 2026-03-26T13:40:20.561Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-41359 |
vulnerable | 2026-06-08 07:25:06.898443 |
Multiple vulnerabilities in Small HTTP server by Smallsrv
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
Published: 2026-03-26T12:20:03.730Z
Updated: 2026-03-26T13:37:41.179Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.