TinyWeb 0.0.8 contains a path traversal flaw that permits unauthenticated attackers to read any file on the host by sending URL paths with /.. sequences. The server concatenates the raw path to the configured web root in HttpBuilder::buildResponse() without normalizing or removing dot segments, allowing an attacker to access sensitive files such as credential stores and private keys when the service runs as root. The weakness is a classic path traversal defect (CWE-22) with a potential to compromise confidentiality on any installation that does not restrict file access.

All installations of GeneralSandman TinyWeb through version 0.0.8 are affected. This includes any build where the web root is unprotected and the process runs with elevated privileges. Users who run TinyWeb with root or broader permissions are at greatest risk.

The CVSS score of 8.7 signals high severity, yet the EPSS score is less than 1 percent and the vulnerability is not listed in CISA KEV, indicating a low calculated exploitation probability. However, because the flaw allows directly reading arbitrary files over the network without authentication, it remains a critical risk for confidentiality. The attack vector is straightforward: an attacker sends a crafted URL containing multiple /.. components that bypass the server’s parsing logic and reach the file system call via HttpFile::setFile().