{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/tinyweb--0.0.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67185"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TinyWeb \u003c= 0.0.8"],"_cs_severities":["high"],"_cs_tags":["path-traversal","webserver","vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["TinyWeb"],"content_html":"\u003cp\u003eTinyWeb, a lightweight web server, is affected by a path traversal vulnerability (CVE-2026-67185) in versions up to and including 0.0.8. This critical flaw allows unauthenticated attackers to read arbitrary files on the server's filesystem. Attackers exploit this by crafting malicious HTTP requests that contain directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e) within the URL path. The vulnerability stems from improper input validation and sanitation in the \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e function, which directly concatenates the attacker-controlled URL path with the configured web root without normalization or boundary checks. This allows the crafted path to be passed directly to \u003ccode\u003eHttpFile::setFile()\u003c/code\u003e, enabling access to sensitive files such as \u003ccode\u003eetc/passwd\u003c/code\u003e or private keys if the TinyWeb process operates with elevated privileges, such as root. This vulnerability poses a significant risk for data exposure on vulnerable servers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a TinyWeb server running a vulnerable version (0.0.8 or earlier).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a GET request to the TinyWeb server, embedding directory traversal sequences (\u003ccode\u003e../\u003c/code\u003e) in the URL path. For example, \u003ccode\u003eGET /../../../../etc/passwd HTTP/1.1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe TinyWeb server receives this HTTP request.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e function processes the incoming URL path.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerability, \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e directly concatenates the crafted URL path, including the \u003ccode\u003e../\u003c/code\u003e sequences, with the server's configured web root path without proper normalization or sanitization.\u003c/li\u003e\n\u003cli\u003eThis improperly formed absolute path is then passed to \u003ccode\u003eHttpFile::setFile()\u003c/code\u003e, which attempts to open and serve the file at the manipulated path.\u003c/li\u003e\n\u003cli\u003eThe TinyWeb server reads and returns the content of an arbitrary file (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e) to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully exfiltrates sensitive information from the server's filesystem, potentially including configuration files, credential stores, or private keys, if the server process has sufficient permissions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-67185 allows unauthenticated attackers to achieve arbitrary file read capabilities on TinyWeb servers. This can lead to the exposure of highly sensitive information, including system configuration files, user credentials, and private cryptographic keys. If the TinyWeb process runs with elevated privileges, such as the \u003ccode\u003eroot\u003c/code\u003e user, the attacker can access any file on the system, significantly increasing the severity of the data breach. The number of potentially affected victims corresponds to the deployment of TinyWeb servers globally, particularly those exposed to the internet. This vulnerability primarily affects web services and any organizations utilizing TinyWeb.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-67185 by upgrading TinyWeb to a version beyond 0.0.8 immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your SIEM to detect attempts at path traversal exploitation against web servers.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for HTTP requests containing directory traversal sequences like \u003ccode\u003e../\u003c/code\u003e or \u003ccode\u003e..\\\u003c/code\u003e in the URI stem or query parameters.\u003c/li\u003e\n\u003cli\u003eEnsure that the TinyWeb server process runs with the lowest possible privileges to minimize the impact of successful exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:22:47Z","date_published":"2026-07-28T17:22:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-path-traversal/","summary":"A path traversal vulnerability, tracked as CVE-2026-67185, exists in TinyWeb through version 0.0.8, allowing unauthenticated attackers to read arbitrary files by submitting '..' sequences in the URL path, bypassing security checks and potentially exposing sensitive data like credential stores or private keys when the server runs with root privileges.","title":"TinyWeb Path Traversal Vulnerability (CVE-2026-67185)","url":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - TinyWeb \u003c= 0.0.8","version":"https://jsonfeed.org/version/1.1"}