CVE-2026-67185 TinyWeb 0.0.8 Path Traversal via URL Path Component
Unauthenticated attackers can read arbitrary files, including credentials, by exploiting path traversal in TinyWeb's URL handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67185?
CVE-2026-67185 is a high-severity path traversal vulnerability in GeneralSandman TinyWeb, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root.
Weakness: CWE-22
Which versions are affected by CVE-2026-67185?
How do I fix CVE-2026-67185?
No fix has been published for CVE-2026-67185 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-67185 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67185 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-qh4x-9gfh-82jc.