PT-2026-4564 · Unknown · Http Server

Jotatito05 · Publicado 2026-01-24 · Atualizado 2026-01-24 · CVE-2026-24469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions C++ HTTP Server versions 1.0 and below

Description C++ HTTP Server is an HTTP/1.1 server designed to manage client connections and process HTTP requests. Versions 1.0 and below contain a flaw that allows a remote, unauthenticated attacker to read arbitrary files from the server’s filesystem. This is possible by creating a malicious HTTP GET request that includes '../' sequences. The application does not properly sanitize the filename variable, which is derived from the URL path provided by the user. This allows the application to concatenate the unsanitized filename to the files directory base path, enabling traversal outside the intended root directory. The vulnerable method is RequestHandler::handleRequest.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-24469

Produtos afetados

Http Server

Referências · 6

• https://github.com/frustratedProton/http-server/security/advisories/GHSA-qp54-6gfq-3gff · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-24469 · Nota de Segurança
• https://t.me/cveNotify/149778 · Publicação no Telegram
• https://t.me/CVEtracker/42904 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2014957827018633404 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014995800099787119 · Publicação no Twitter