Serviio PRO 1.8 contains an unquoted search path vulnerability in its Windows service that allows a local user to run arbitrary code with elevated privileges by placing malicious executables in a system root path. In addition, the installer sets the directory permissions for the Users group to full access, enabling authenticated users to overwrite the executable file with another binary. This weakness can be exploited to hijack the service startup or a system reboot, granting the attacker full control over the affected machine. The problem is categorized as CWE‑428, which warns about the risks of unquoted paths leading to unintended program execution.

The vulnerability affects Serviio PRO version 1.8 running on Windows operating systems. Only this specific version is known to contain the unquoted path and directory permission issues. No other versions or non‑Windows platforms are mentioned.

The CVSS score of 8.5 indicates a high severity for the flaw, with a major impact on confidentiality and integrity when exploited. The EPSS score of less than 1% suggests that the likelihood of this vulnerability being weaponized in the wild is low, and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must have a local user account or otherwise be able to write to the system root directory to replace the executable. Once the malicious binary is in place, the service will load it with system privileges during startup or reboots, achieving privilege escalation.