HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67185 — TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauth...

·Source: NIST NVD

Updated:

Executive Summary

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through th

Analysis

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through the URL parser unchanged and reach the filesystem call via HttpFile::setFile(), exposing sensitive files such as credential stores and private keys when the server process runs as root. CVSS Score: 7.5. Published: 2026-07-28T17:17:08.013.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67185
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 28, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Tech jobs go as Visa cuts workforce by 7%

Visa is set to cut around 2600 jobs - seven per cent of its workforce - with technology and product roles taking the brunt of the hit as the payments giant reconfigures its operations for the AI era.

Finextra
LOWVulnerabilityNEW

Ramp enters Canada

Ramp today announced its entry into the Canadian market, making its finance platform available to businesses in Canada. With Ramp, companies can manage spend across currencies in one place, including cards in CAD and USD, CAD bill payments and reimbursements, automated GST, HST, PST, and QST coding, and shared controls, approvals, and accounting workflows.

Finextra
MEDIUMVulnerabilityNEW

Rent payment fintech Flexible Finance applies for bank license

Flexible Finance, Inc. (“Flex”), the financial technology company behind Flex Rent, today announced it has submitted applications to the Federal Deposit Insurance Corporation (“FDIC”) and the Utah Department of Financial Institutions (“UDFI”) to charter Flex Bank, a Utah state-chartered industrial bank.

Finextra