PT-2025-49798 · Unknown · Static Web Server

Published 2025-12-09 · Updated 2025-12-11 · CVE-2025-67487

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Static Web Server versions 2.40.0 and below

Description Static Web Server (SWS) is a web server designed for static web files. Versions 2.40.0 and below do not adequately prevent symbolic links (symlinks) from being used to access files and directories outside the intended web root folder. A malicious actor who gains access to the web server’s root directory can create symlinks to access other files outside the designated web root folder, either through a URL or by using directory listings.

Recommendations Update to version 2.40.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

CVE-2025-67487

GHSA-459F-X8VQ-XJJM

Affected Products

Static Web Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67487.json · Exploit
• 🔥 https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm · Exploit
• https://github.com/static-web-server/static-web-server/commit/308f0d26ceb9c2c8bd219315d0f53914763357f2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-67487 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67487 · Vendor Advisory
• https://twitter.com/dailycve/status/1999167470091849798 · Twitter Post
• https://t.me/CVEtracker/39206 · Telegram Post
• https://twitter.com/CVEnew/status/1998355386714525999 · Twitter Post