The Small HTTP Server version 3.06.36 contains an authenticated path‑traversal flaw in the root path that permits an attacker to bypass the server’s SecurityManager and read arbitrary files located outside the configured document root. This defect allows remote users who have the necessary file system permissions to retrieve sensitive content, potentially exposing confidential information or system configuration files. The weakness is classified as a Path Traversal (CWE‑22) issue.

The vulnerable product is the Small HTTP Server from Smallsrv, specifically version 3.06.36. The vendor has released a fixed version, 3.06.38, which addresses the path‑traversal vulnerability. The CPE entries list both the exact vulnerable version and the broader small_http_server package, indicating that only the 3.06.36 release is affected.

The flaw carries a CVSS score of 8.7, indicating a high potential impact if exploited. However, the EPSS score is less than 1 %, suggesting that exploitation has not yet been widely observed and is unlikely to be actively targeted. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a valid authenticated user who has sufficient file‑system permissions; the attacker typically sends a crafted request to the root path containing traversal sequences, causing the server to return the contents of the targeted file. The remote nature of the attack, coupled with the need for authentication, limits the attack surface but still presents a serious risk of data exposure.