Executive brief
TinyWeb, a lightweight web server, contains a security flaw that allows unauthorized individuals to access any file on the host system. By sending a specially crafted web request, an attacker can bypass folder restrictions to view sensitive data such as passwords, private encryption keys, and system configuration files. This could lead to a full system compromise, especially if the server is running with administrative privileges.
Technical details
A path traversal vulnerability exists in TinyWeb through version 0.0.8 due to insufficient input validation in the HttpBuilder::buildResponse() function. The server concatenates the requested URL path directly to the configured web root without performing dot-segment removal (RFC 3986) or path canonicalization. An unauthenticated remote attacker can exploit this by sending a GET request containing literal '../' sequences, which pass through the URL parser and reach the HttpFile::setFile() filesystem call. If the server process is running as root, this allows the retrieval of any file on the filesystem, including /etc/shadow and private keys. As of the advisory date, no patch is available.
Affected products
- GeneralSandman TinyWeb 0.0.8 and earlier
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed by researcher Theodosis Paidakis
- 2026-07-28: advisory: NVD and VulnCheck advisories published