PT-2026-4564 · Unknown · Http Server

Jotatito05 · Published 2026-01-24 · Updated 2026-01-24 · CVE-2026-24469

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions C++ HTTP Server versions 1.0 and below

Description C++ HTTP Server is an HTTP/1.1 server designed to manage client connections and process HTTP requests. Versions 1.0 and below contain a flaw that allows a remote, unauthenticated attacker to read arbitrary files from the server’s filesystem. This is possible by creating a malicious HTTP GET request that includes '../' sequences. The application does not properly sanitize the filename variable, which is derived from the URL path provided by the user. This allows the application to concatenate the unsanitized filename to the files directory base path, enabling traversal outside the intended root directory. The vulnerable method is RequestHandler::handleRequest.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-24469

Affected Products

Http Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-24469 · Security Note
• https://github.com/frustratedProton/http-server/security/advisories/GHSA-qp54-6gfq-3gff · Note
• https://t.me/cveNotify/149778 · Telegram Post
• https://t.me/CVEtracker/42904 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014957827018633404 · Twitter Post
• https://twitter.com/CVEnew/status/2014995800099787119 · Twitter Post