PT-2026-28284 · Unknown · Small Http Server

Rafael Pedrero · Published 2026-03-26 · Updated 2026-03-29 · CVE-2025-41359

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Small HTTP Server version 3.06.36

Description The issue involves an unquoted service path in Small HTTP Server. Specifically, the vulnerability affects the executable located at 'C:Program Files (x86)shttps mghttp.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a directory with higher priority, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could lead to arbitrary code execution, unauthorized system access, or service disruption. The vulnerable path is associated with the service configuration.

Recommendations Ensure the service path is properly quoted. Restrict physical and network access to the system.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2025-41359

Affected Products

Small Http Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41359 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv · Patch
• https://twitter.com/CVEnew/status/2038135235758670002 · Twitter Post
• https://twitter.com/cyberbivash/status/2037164394648351099 · Twitter Post