{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/tinyweb/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67185"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TinyWeb \u003c= 0.0.8"],"_cs_severities":["high"],"_cs_tags":["path-traversal","webserver","vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["TinyWeb"],"content_html":"\u003cp\u003eTinyWeb, a lightweight web server, is affected by a path traversal vulnerability (CVE-2026-67185) in versions up to and including 0.0.8. This critical flaw allows unauthenticated attackers to read arbitrary files on the server's filesystem. Attackers exploit this by crafting malicious HTTP requests that contain directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e) within the URL path. The vulnerability stems from improper input validation and sanitation in the \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e function, which directly concatenates the attacker-controlled URL path with the configured web root without normalization or boundary checks. This allows the crafted path to be passed directly to \u003ccode\u003eHttpFile::setFile()\u003c/code\u003e, enabling access to sensitive files such as \u003ccode\u003eetc/passwd\u003c/code\u003e or private keys if the TinyWeb process operates with elevated privileges, such as root. This vulnerability poses a significant risk for data exposure on vulnerable servers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a TinyWeb server running a vulnerable version (0.0.8 or earlier).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a GET request to the TinyWeb server, embedding directory traversal sequences (\u003ccode\u003e../\u003c/code\u003e) in the URL path. For example, \u003ccode\u003eGET /../../../../etc/passwd HTTP/1.1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe TinyWeb server receives this HTTP request.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e function processes the incoming URL path.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerability, \u003ccode\u003eHttpBuilder::buildResponse()\u003c/code\u003e directly concatenates the crafted URL path, including the \u003ccode\u003e../\u003c/code\u003e sequences, with the server's configured web root path without proper normalization or sanitization.\u003c/li\u003e\n\u003cli\u003eThis improperly formed absolute path is then passed to \u003ccode\u003eHttpFile::setFile()\u003c/code\u003e, which attempts to open and serve the file at the manipulated path.\u003c/li\u003e\n\u003cli\u003eThe TinyWeb server reads and returns the content of an arbitrary file (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e) to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully exfiltrates sensitive information from the server's filesystem, potentially including configuration files, credential stores, or private keys, if the server process has sufficient permissions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-67185 allows unauthenticated attackers to achieve arbitrary file read capabilities on TinyWeb servers. This can lead to the exposure of highly sensitive information, including system configuration files, user credentials, and private cryptographic keys. If the TinyWeb process runs with elevated privileges, such as the \u003ccode\u003eroot\u003c/code\u003e user, the attacker can access any file on the system, significantly increasing the severity of the data breach. The number of potentially affected victims corresponds to the deployment of TinyWeb servers globally, particularly those exposed to the internet. This vulnerability primarily affects web services and any organizations utilizing TinyWeb.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-67185 by upgrading TinyWeb to a version beyond 0.0.8 immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your SIEM to detect attempts at path traversal exploitation against web servers.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003ewebserver\u003c/code\u003e logs for HTTP requests containing directory traversal sequences like \u003ccode\u003e../\u003c/code\u003e or \u003ccode\u003e..\\\u003c/code\u003e in the URI stem or query parameters.\u003c/li\u003e\n\u003cli\u003eEnsure that the TinyWeb server process runs with the lowest possible privileges to minimize the impact of successful exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:22:47Z","date_published":"2026-07-28T17:22:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-path-traversal/","summary":"A path traversal vulnerability, tracked as CVE-2026-67185, exists in TinyWeb through version 0.0.8, allowing unauthenticated attackers to read arbitrary files by submitting '..' sequences in the URL path, bypassing security checks and potentially exposing sensitive data like credential stores or private keys when the server runs with root privileges.","title":"TinyWeb Path Traversal Vulnerability (CVE-2026-67185)","url":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-path-traversal/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-67184"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TinyWeb (\u003c= 0.0.8)"],"_cs_severities":["low"],"_cs_tags":["web-vulnerability","denial-of-service","cve"],"_cs_type":"advisory","_cs_vendors":["TinyWeb"],"content_html":"\u003cp\u003eTinyWeb versions up to and including 0.0.8 are vulnerable to a null pointer dereference, tracked as CVE-2026-67184. This critical vulnerability allows unauthenticated remote attackers to trigger a denial of service by sending a specially crafted HTTP request. The attack is initiated by providing a malformed HTTP request line that contains an invalid version string. When the \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function processes this invalid input, it fails to correctly allocate the \u003ccode\u003eUrl\u003c/code\u003e object, leaving its pointer \u003ccode\u003eNULL\u003c/code\u003e. Subsequently, the \u003ccode\u003ebuildResponse()\u003c/code\u003e function attempts to dereference this \u003ccode\u003eNULL\u003c/code\u003e pointer without proper validation, leading to a Segmentation Fault (\u003ccode\u003eSIGSEGV\u003c/code\u003e). This crash terminates the worker process, and if sufficient malformed requests are sent, all worker processes can be brought down, rendering the TinyWeb server permanently offline until manual intervention. This poses a significant threat to the availability of services running on affected TinyWeb instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker sends an HTTP request to a vulnerable TinyWeb server (version 0.0.8 or earlier).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the HTTP request line to include an invalid or malformed version string (e.g., \u003ccode\u003eGET / HTTP/MALFORMED\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe TinyWeb server's \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function attempts to parse the incoming malformed HTTP request.\u003c/li\u003e\n\u003cli\u003eDue to the invalid version string, the \u003ccode\u003eHttpParser::execute()\u003c/code\u003e function fails to allocate the \u003ccode\u003eUrl\u003c/code\u003e object, leaving the \u003ccode\u003eurl\u003c/code\u003e pointer as \u003ccode\u003eNULL\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server then proceeds to call the \u003ccode\u003ebuildResponse()\u003c/code\u003e function to formulate a response.\u003c/li\u003e\n\u003cli\u003eWithin \u003ccode\u003ebuildResponse()\u003c/code\u003e, an attempt is made to dereference the \u003ccode\u003eNULL\u003c/code\u003e \u003ccode\u003eurl\u003c/code\u003e pointer without checking the \u003ccode\u003evalid_requ\u003c/code\u003e flag.\u003c/li\u003e\n\u003cli\u003eThis \u003ccode\u003eNULL\u003c/code\u003e pointer dereference triggers a Segmentation Fault (\u003ccode\u003eSIGSEGV\u003c/code\u003e), causing the worker process handling the request to crash and terminate.\u003c/li\u003e\n\u003cli\u003eBy repeatedly sending such malformed requests, the attacker can crash all available worker processes, leading to a complete denial-of-service for the TinyWeb server until it is manually restarted.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-67184 leads to a complete denial-of-service for the TinyWeb server. Attackers can remotely crash worker processes by sending malformed HTTP requests, eventually taking the server permanently offline. This directly impacts the availability of any web services hosted by TinyWeb, disrupting operations and potentially causing significant financial and reputational damage. There is no specific information on the number of victims or targeted sectors, but any organization using TinyWeb through version 0.0.8 for their web infrastructure is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch TinyWeb immediately to a version greater than 0.0.8 to remediate CVE-2026-67184.\u003c/li\u003e\n\u003cli\u003eImplement robust monitoring of web server logs for indicators of malformed HTTP requests, specifically looking for unusual or invalid HTTP version strings.\u003c/li\u003e\n\u003cli\u003eDeploy network intrusion detection systems (NIDS) to identify and block HTTP requests containing non-standard or malformed version strings before they reach web servers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:22:09Z","date_published":"2026-07-28T17:22:09Z","id":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-null-dereference/","summary":"A null pointer dereference vulnerability, CVE-2026-67184, in TinyWeb through version 0.0.8 allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string, leading to a denial of service.","title":"Null Pointer Dereference Vulnerability in TinyWeb","url":"https://feed.craftedsignal.io/briefs/2026-07-tinyweb-null-dereference/"}],"language":"en","title":"CraftedSignal Threat Feed - TinyWeb","version":"https://jsonfeed.org/version/1.1"}