A path traversal vulnerability in Small HTTP Server allows authenticated users to bypass security restrictions and access unauthorized files on the host system.

This is a path traversal flaw (CWE-22) located in the root directory handling of the server, which can be triggered by any authenticated user to bypass the SecurityManager and read arbitrary files.

The ability to perform unauthorized file access poses a severe risk to data confidentiality and system integrity. With a CVSS score of 8.1, this high-severity vulnerability could allow an attacker to retrieve sensitive configuration files, credentials, or proprietary data, potentially leading to a full system compromise.

Immediate Action: Update the Small HTTP Server installation to version 3.06.38 or later to resolve the underlying path traversal issue.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically those containing directory traversal sequences like double dots or absolute path references.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing directory traversal payloads directed at the server root.

Public Exploit Available: Unknown

The vulnerability presents a significant risk to the security of the Small HTTP Server environment. Administrators should prioritize upgrading to version 3.06.38 immediately to eliminate the path traversal vector. Continued vigilance through log monitoring is advised to detect any attempts to leverage this or similar flaws during the transition period.