An unquoted service path in Small HTTP Server 3.06.36 allows a local user to place a malicious executable in a higher‑priority directory, causing the service to run that file instead of the legitimate ‘http.exe’ service file. This flaw is a local privilege escalation that enables arbitrary code execution, potentially leading to unauthorized system access or service disruption. The weakness is classified as CWE‑428, unquoted service paths.

The vulnerability affects Smallsrv’s Small HTTP Server, specifically version 3.06.36. Any deployment running this or prior release versions of the server is susceptible. The vendor has released version 3.06.38 that contains the fix.

The CVSS score of 8.5 indicates high severity, but EPSS data is unavailable, so exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploit. Attack requires local access to the machine or the ability to write files to its directory, which could be achieved through physical access or remote compromise with sufficient privileges. The patch is readily available, so systems should be updated promptly to eliminate the risk.