CVE-2026-67185highCWE-22

CVE-2026-67185: high-severity vulnerability in GeneralSandman TinyWeb

TinyWeb 0.0.8 Path Traversal via URL Path Component

Published

Follow this CVE+ Monitor TinyWeb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.7epss 0.5%
from disclosure to weaponsame day
Published on NVDJul 28
1st PoCJul 26
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
GeneralSandman · TinyWeb
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GeneralSandman TinyWeb

In the same product, most dangerous first.

CVE-2026-67184HIGHTinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP RequestEPSS 0.6%CVE-2026-67183HIGHTinyWeb 0.0.8 Memory Leak DoS via HTTP Request HandlingEPSS 0.5%