Junglewise Threat Intelligence

CVE-2025-67487: Static Web Server vulnerable to a symbolic link path traversal

CVE-2025-67487 · Severity: medium · CVSS 4 · Published 2025-12-08

Technologies: static-web-server (crates.io). Vendors: crates.io.

Executive brief

Static Web Server vulnerable to a symbolic link path traversal

Affected products

crates.io static-web-server

Related threats

Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names