CVE-2026-67185

Name of the Vulnerable Software and Affected Versions TinyWeb versions 0.0.1 through 0.0.8

Description An issue allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. These sequences are concatenated directly to the configured web root in the buildResponse() function of HttpBuilder without normalization, dot-segment removal, or boundary checks. Attackers can craft requests that pass through the URL parser unchanged and reach the filesystem call via the setFile() function of HttpFile, potentially exposing sensitive files like credential stores and private keys if the server process runs as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.