A critical unquoted service path vulnerability in Small HTTP Server 3.06.36 allows local attackers to execute arbitrary code with elevated privileges.

The software uses an unquoted service path for the executable, which permits a local user to escalate privileges by placing a rogue binary in a directory that the service path resolves to before the legitimate executable. This flaw requires local access but allows an attacker to bypass standard security boundaries.

Successful exploitation grants an attacker the ability to run arbitrary code on the host system with the privileges of the service, typically resulting in full system compromise. Given the CVSS score of 7.8, this represents a high-severity risk to confidentiality, integrity, and availability that could lead to unauthorized data access or complete service disruption.

Immediate Action: Update the Small HTTP Server installation to version V3.06.38 or later to resolve the path configuration issue.

Proactive Monitoring: Review system event logs for unauthorized service installations or unexpected process executions originating from the application directory.

Compensating Controls: If an immediate update is not possible, ensure that directory permissions for the service path are strictly locked down to prevent non-administrative users from writing or modifying files in the parent directories.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant due to the potential for local privilege escalation and arbitrary code execution. Administrators should prioritize upgrading to version V3.06.38 immediately to remediate the path configuration flaw and prevent potential system takeover by local actors.