TinyWeb - CraftedSignal Threat Feed

TinyWeb Path Traversal Vulnerability (CVE-2026-67185)

hello@craftedsignal.io — Tue, 28 Jul 2026 17:22:47 +0000

TinyWeb, a lightweight web server, is affected by a path traversal vulnerability (CVE-2026-67185) in versions up to and including 0.0.8. This critical flaw allows unauthenticated attackers to read arbitrary files on the server's filesystem. Attackers exploit this by crafting malicious HTTP requests that contain directory traversal sequences (e.g., ../) within the URL path. The vulnerability stems from improper input validation and sanitation in the HttpBuilder::buildResponse() function, which directly concatenates the attacker-controlled URL path with the configured web root without normalization or boundary checks. This allows the crafted path to be passed directly to HttpFile::setFile(), enabling access to sensitive files such as etc/passwd or private keys if the TinyWeb process operates with elevated privileges, such as root. This vulnerability poses a significant risk for data exposure on vulnerable servers.

Attack Chain

An unauthenticated attacker identifies a TinyWeb server running a vulnerable version (0.0.8 or earlier).
The attacker crafts a GET request to the TinyWeb server, embedding directory traversal sequences (../) in the URL path. For example, GET /../../../../etc/passwd HTTP/1.1.
The TinyWeb server receives this HTTP request.
The HttpBuilder::buildResponse() function processes the incoming URL path.
Due to the vulnerability, HttpBuilder::buildResponse() directly concatenates the crafted URL path, including the ../ sequences, with the server's configured web root path without proper normalization or sanitization.
This improperly formed absolute path is then passed to HttpFile::setFile(), which attempts to open and serve the file at the manipulated path.
The TinyWeb server reads and returns the content of an arbitrary file (e.g., /etc/passwd) to the attacker.
The attacker successfully exfiltrates sensitive information from the server's filesystem, potentially including configuration files, credential stores, or private keys, if the server process has sufficient permissions.

Impact

The successful exploitation of CVE-2026-67185 allows unauthenticated attackers to achieve arbitrary file read capabilities on TinyWeb servers. This can lead to the exposure of highly sensitive information, including system configuration files, user credentials, and private cryptographic keys. If the TinyWeb process runs with elevated privileges, such as the root user, the attacker can access any file on the system, significantly increasing the severity of the data breach. The number of potentially affected victims corresponds to the deployment of TinyWeb servers globally, particularly those exposed to the internet. This vulnerability primarily affects web services and any organizations utilizing TinyWeb.

Recommendation

Patch CVE-2026-67185 by upgrading TinyWeb to a version beyond 0.0.8 immediately.
Deploy the Sigma rule provided in this brief to your SIEM to detect attempts at path traversal exploitation against web servers.
Monitor webserver logs for HTTP requests containing directory traversal sequences like ../ or ..\ in the URI stem or query parameters.
Ensure that the TinyWeb server process runs with the lowest possible privileges to minimize the impact of successful exploitation.

Null Pointer Dereference Vulnerability in TinyWeb

hello@craftedsignal.io — Tue, 28 Jul 2026 17:22:09 +0000

TinyWeb versions up to and including 0.0.8 are vulnerable to a null pointer dereference, tracked as CVE-2026-67184. This critical vulnerability allows unauthenticated remote attackers to trigger a denial of service by sending a specially crafted HTTP request. The attack is initiated by providing a malformed HTTP request line that contains an invalid version string. When the HttpParser::execute() function processes this invalid input, it fails to correctly allocate the Url object, leaving its pointer NULL. Subsequently, the buildResponse() function attempts to dereference this NULL pointer without proper validation, leading to a Segmentation Fault (SIGSEGV). This crash terminates the worker process, and if sufficient malformed requests are sent, all worker processes can be brought down, rendering the TinyWeb server permanently offline until manual intervention. This poses a significant threat to the availability of services running on affected TinyWeb instances.

Attack Chain

An unauthenticated remote attacker sends an HTTP request to a vulnerable TinyWeb server (version 0.0.8 or earlier).
The attacker crafts the HTTP request line to include an invalid or malformed version string (e.g., GET / HTTP/MALFORMED).
The TinyWeb server's HttpParser::execute() function attempts to parse the incoming malformed HTTP request.
Due to the invalid version string, the HttpParser::execute() function fails to allocate the Url object, leaving the url pointer as NULL.
The server then proceeds to call the buildResponse() function to formulate a response.
Within buildResponse(), an attempt is made to dereference the NULL url pointer without checking the valid_requ flag.
This NULL pointer dereference triggers a Segmentation Fault (SIGSEGV), causing the worker process handling the request to crash and terminate.
By repeatedly sending such malformed requests, the attacker can crash all available worker processes, leading to a complete denial-of-service for the TinyWeb server until it is manually restarted.

Impact

Successful exploitation of CVE-2026-67184 leads to a complete denial-of-service for the TinyWeb server. Attackers can remotely crash worker processes by sending malformed HTTP requests, eventually taking the server permanently offline. This directly impacts the availability of any web services hosted by TinyWeb, disrupting operations and potentially causing significant financial and reputational damage. There is no specific information on the number of victims or targeted sectors, but any organization using TinyWeb through version 0.0.8 for their web infrastructure is at risk.

Recommendation

Patch TinyWeb immediately to a version greater than 0.0.8 to remediate CVE-2026-67184.
Implement robust monitoring of web server logs for indicators of malformed HTTP requests, specifically looking for unusual or invalid HTTP version strings.
Deploy network intrusion detection systems (NIDS) to identify and block HTTP requests containing non-standard or malformed version strings before they reach web servers.