This vulnerability is a local privilege escalation flaw that arises from an unquoted search path in CivetWeb 1.16. The service configuration concatenates directories before the intended application path, so when a malicious executable is placed in a preceding directory, it can be executed with the same privileges as the CivetWeb service. An attacker who can write files to any of these directories can therefore run arbitrary code with elevated privileges on the system.

CivetWeb version 1.16 on Windows platforms where the CivetWeb service is installed. The flaw is linked to the typical installation path C:\Program Files\CivetWeb\CivetWeb.exe and the ability of the service to search preceding directories on the file system.

The flaw carries a CVSS score of 8.5, indicating a high severity risk. EPSS data is not available, but the lack of a published patch and the critical impact suggest that exploitation is plausible if an attacker can write to the relevant directories. The vulnerability is not listed in CISA’s KEV catalog, yet the local nature of the attack may appeal to attackers targeting compromised systems or exploiting privileged service configurations.