PT-2021-7216 · Unknown · Http File Server

Eddie Zhang · Published 2021-07-09 · Updated 2025-12-15 · CVE-2021-40668

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions HTTP File Server version 1.4.1

Description The issue is related to a path traversal vulnerability that allows for arbitrary directory listing, file read, and file write. This is due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may permit a remote attacker to read, modify, or delete files.

Recommendations For version 1.4.1, consider restricting access to sensitive directories and files as a temporary workaround until a patch is available. Avoid using the application for sensitive file storage or transfer until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-03873

CVE-2021-40668

Affected Products

Http File Server

References · 8

• 🔥 https://eddiez.me/path-traversal-in-slowscript-httpfileserver · Exploit
• https://osv.dev/vulnerability/CVE-2021-40668 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03873 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-40668 · Security Note
• https://play.google.com/store/apps/details?id=slowscript.httpfileserver · Note
• https://t.me/cibsecurity/44087 · Telegram Post
• https://aapks.com/apk/http-file-server-slowscript/version/59235436 · Note
• https://vuldb.com/ru/?id.201521 · Note