CVE-2026-5789 Search path without quotes in CivetWeb

High 8.5 Published 21 Apr 2026 Updated 21 Apr 2026

A local attacker can execute arbitrary code with elevated privileges by exploiting an unquoted search path in the CivetWeb service configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-5789?

CVE-2026-5789 is a high-severity vulnerability in CivetWeb, published on 21 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.

Weakness: CWE-428

Which versions are affected by CVE-2026-5789?

It affects 1 product.

Products include Civetweb Project Civetweb.

How do I fix CVE-2026-5789?

No fix has been published for CVE-2026-5789 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-5789 being exploited?

There is no known exploitation of CVE-2026-5789 in the wild and no public exploit code.

Sources

Also known as GHSA-9vxj-j2f7-9mgg, UBUNTU-CVE-2026-5789.