Vulnerability in Smallsrv Small HTTP
CVE-2025-41359
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (4.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Smallsrv Small HTTP — versions 3.06.36
- Smallsrv Small HTTP Server
Weakness classification (CWE)
References
- www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-… (Third Party Advisory, patch)
Frequently asked questions
- What is CVE-2025-41359?
- CVE-2025-41359 is a high-severity vulnerability in Smallsrv Small HTTP, classified under Unquoted Search Path or Element. CVSS score: 7.8/10. Published 2026-03-26.
- How severe is CVE-2025-41359?
- High severity. CVSS v3 base score is 7.8 out of 10.