CVE-2026-67185: TinyWeb Path Traversal Vulnerability

CVE-2026-67185 Overview

CVE-2026-67185 is an unauthenticated path traversal vulnerability [CWE-22] affecting TinyWeb through version 0.0.8. The flaw resides in the HttpBuilder::buildResponse() function, which concatenates user-supplied URL path components directly to the configured web root without normalization or dot-segment removal. Attackers can submit ../ sequences that pass through the URL parser unchanged and reach HttpFile::setFile(), exposing arbitrary files on the host filesystem. When the TinyWeb process runs as root, attackers can read credential stores, private keys, and other sensitive files with a single crafted HTTP request.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the server filesystem, including credential stores and private keys, without any user interaction.

Affected Products

TinyWeb versions through 0.0.8
Deployments running the TinyWeb process as root
Any host exposing TinyWeb over the network

Discovery Timeline

2026-07-28 - CVE-2026-67185 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67185

Vulnerability Analysis

The vulnerability exists in TinyWeb's HTTP request handling pipeline. The HttpBuilder::buildResponse() function receives the URL path component from the parser and appends it to the configured document root string. The function performs no canonicalization, no dot-segment collapsing per RFC 3986 Section 5.2.4, and no boundary check that the resolved path remains within the web root.

Because the URL parser preserves ../ sequences verbatim, the assembled filesystem path traverses upward beyond the intended directory. HttpFile::setFile() then opens the resulting path directly, returning the file contents in the HTTP response body. The request requires no authentication and no valid session state.

Exploitation returns file contents such as /etc/shadow, SSH host keys under /etc/ssh/, and application configuration files containing database credentials. The impact is confined to confidentiality; the CVSS vector indicates no integrity or availability impact.

Root Cause

The root cause is missing input validation on the URL path component before filesystem access. TinyWeb trusts the request-target segment of the HTTP request line and treats it as a safe suffix for path concatenation. Standard defenses such as realpath() verification, prefix matching against the resolved web root, or rejection of .. segments are absent from the request-to-file mapping code.

Attack Vector

The attack requires a single HTTP GET request containing traversal sequences in the URL path. An unauthenticated remote attacker sends a request such as GET /../../../../etc/shadow HTTP/1.1 to the TinyWeb listener. The server resolves the path, opens the target file through HttpFile::setFile(), and returns its contents in the HTTP response.

The vulnerability manifests before any application logic executes and does not require special headers, cookies, or prior reconnaissance beyond identifying the service. See the VulnCheck Security Advisory and the GitHub PoC Repository for full request details.

Detection Methods for CVE-2026-67185

Indicators of Compromise

HTTP request logs containing ../ or URL-encoded %2e%2e%2f sequences in the request path
Access log entries referencing absolute paths outside the configured web root, such as /etc/, /root/, or /home/
Unusual HTTP 200 responses for requests to file paths that do not correspond to published web content
Outbound file reads from the TinyWeb process targeting credential files or SSH keys

Detection Strategies

Alert on any TinyWeb access log entry where the request URI contains .., %2e%2e, or backslash-encoded traversal variants
Correlate TinyWeb process file-open events against a defined web root prefix and flag any read outside that prefix
Monitor for repeated 200-status responses to non-standard paths, indicating successful file exfiltration

Monitoring Recommendations

Enable verbose HTTP access logging on all TinyWeb instances and forward logs to a central analytics platform
Deploy a reverse proxy or web application firewall in front of TinyWeb to log and normalize traversal attempts
Track file-system access events from the TinyWeb process using auditd or eBPF-based telemetry

How to Mitigate CVE-2026-67185

Immediate Actions Required

Restrict network exposure of TinyWeb to trusted networks only until a patched build is available
Run the TinyWeb process under a dedicated unprivileged user account rather than root to limit file access on successful exploitation
Deploy a reverse proxy that normalizes URL paths and rejects requests containing .. segments before they reach TinyWeb
Audit hosts running TinyWeb for exposure of credential stores, private keys, and configuration files readable by the service account

Patch Information

No vendor patch is referenced in the published advisory sources at the time of publication. Monitor the VulnCheck Security Advisory and the TinyWeb project repository for a fixed release. Upgrade beyond version 0.0.8 once a patched build becomes available.

Workarounds

Place TinyWeb behind an nginx or Apache reverse proxy configured to reject or rewrite paths containing traversal sequences
Apply filesystem-level access controls so the TinyWeb service account cannot read sensitive files such as /etc/shadow or SSH private keys
Chroot the TinyWeb process into a directory containing only the intended web assets
Block inbound requests containing ../, %2e%2e%2f, and encoded variants at the network perimeter

bash

# Example nginx reverse proxy configuration that blocks traversal sequences
location / {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 400;
    }
    proxy_pass http://127.0.0.1:8080;
}