CVE-2025-41368: Smallsrv Path Traversal Vulnerability

CVE-2025-41368 Overview

CVE-2025-41368 is an authenticated path traversal vulnerability affecting Small HTTP Server v3.06.36. This security flaw allows remote authenticated users to bypass the SecurityManager's intended restrictions and access arbitrary files outside the configured document root. By manipulating the root path (/), attackers with valid credentials can read sensitive files on the server that should otherwise be protected.

Critical Impact

Authenticated attackers can bypass access controls to read arbitrary files outside the web root, potentially exposing sensitive configuration files, credentials, and system data.

Affected Products

• Smallsrv Small HTTP Server v3.06.36
• Small HTTP Server versions prior to security patch

Discovery Timeline

• March 26, 2026 - CVE-2025-41368 published to NVD
• March 26, 2026 - Last updated in NVD database

Technical Details for CVE-2025-41368

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the Small HTTP Server's request handling mechanism. The server fails to properly sanitize user-supplied input when processing file path requests through the root endpoint. Although the SecurityManager component is designed to restrict file access to the configured document root, authenticated users can craft malicious requests that traverse outside this boundary.

The vulnerability requires authentication, meaning only users with valid credentials can exploit it. However, once authenticated, an attacker can potentially access any file readable by the web server process, including configuration files, application source code, database credentials, and other sensitive system files.

Root Cause

The root cause lies in insufficient input validation and path canonicalization when processing requests through the / endpoint. The SecurityManager's access control checks do not adequately prevent directory traversal sequences (such as ../) from escaping the document root. This allows authenticated users to construct request paths that resolve to locations outside the intended web directory.

Attack Vector

The attack is network-based and requires low complexity to execute. An attacker must first authenticate to the Small HTTP Server, then craft HTTP requests containing path traversal sequences. By sending requests with specially crafted paths through the root endpoint, the attacker can read arbitrary files from the underlying system, limited only by the file system permissions of the web server process.

The vulnerability allows access to files outside the document root when an attacker includes directory traversal sequences in their HTTP requests. For example, requests targeting parent directory paths can escape the configured web root and access sensitive system files such as /etc/passwd on Linux systems or configuration files on Windows systems. See the INCIBE Security Notice for technical details.

Detection Methods for CVE-2025-41368

Indicators of Compromise

• HTTP access logs showing requests containing ../ or ..%2f sequences from authenticated users
• Unusual file access patterns in server logs indicating access to files outside the document root
• Multiple sequential requests targeting sensitive system paths such as /etc/passwd, /etc/shadow, or Windows configuration files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Monitor HTTP request logs for directory traversal sequences including encoded variants (%2e%2e%2f, ..%5c)
• Configure intrusion detection systems (IDS) to alert on requests containing path traversal indicators
• Review authentication logs for accounts making suspicious file access requests

Monitoring Recommendations

• Enable verbose logging on the Small HTTP Server to capture full request paths
• Set up alerting for any 200 OK responses to requests containing traversal patterns
• Monitor file system access logs for the web server process accessing files outside the document root
• Implement real-time log analysis to correlate authentication events with suspicious file access attempts

How to Mitigate CVE-2025-41368

Immediate Actions Required

• Restrict network access to the Small HTTP Server to trusted IP addresses only
• Implement additional authentication controls and review user account privileges
• Deploy a web application firewall (WAF) with rules to block path traversal attempts
• Consider taking the server offline or replacing it with a more secure alternative until a patch is available

Patch Information

Consult the vendor for patch availability. Review the INCIBE Security Notice for the latest information on updates and remediation guidance. If no patch is available, consider migrating to an alternative HTTP server solution.

Workarounds

• Configure external access controls (firewall rules) to limit who can reach the server
• Implement a reverse proxy with path validation to filter malicious requests before they reach the vulnerable server
• Restrict the web server process to run with minimal filesystem permissions
• Monitor and audit all authenticated user access for suspicious activity

# Example: Block path traversal patterns using iptables string matching
iptables -A INPUT -p tcp --dport 80 -m string --string "../" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 80 -m string --string "..%2f" --algo bm -j DROP