CVE-2025-41368 Multiple vulnerabilities in Small HTTP server by Smallsrv

High 8.7 Published 26 Mar 2026 Updated 26 Mar 2026

Authenticated attackers can bypass SecurityManager restrictions to read arbitrary files outside the document root in Small HTTP Server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-41368?

CVE-2025-41368 is a high-severity path traversal vulnerability in Smallsrv Small HTTP, published on 26 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.

Weakness: CWE-22

Which versions are affected by CVE-2025-41368?

It affects 1 product.

Products include Smallsrv Small Http Server.

How do I fix CVE-2025-41368?

No fix has been published for CVE-2025-41368 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-41368 being exploited?

There is no known exploitation of CVE-2025-41368 in the wild and no public exploit code.

Sources

Also known as GHSA-gm55-992f-6xm4.