CVE-2025-41359 Multiple vulnerabilities in Small HTTP server by Smallsrv
Local attackers can execute arbitrary code by exploiting an unquoted service path in Small HTTP Server, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41359?
CVE-2025-41359 is a high-severity vulnerability in Smallsrv Small HTTP, published on 26 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
Weakness: CWE-428
Which versions are affected by CVE-2025-41359?
It affects 1 product.
Products include Smallsrv Small Http Server.
How do I fix CVE-2025-41359?
No fix has been published for CVE-2025-41359 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41359 being exploited?
There is no known exploitation of CVE-2025-41359 in the wild and no public exploit code.
Other vulnerabilities in Smallsrv Small HTTP
Sources
Also known as GHSA-p44p-8r2h-6r26.