Small HTTP Server Unquoted Service Path Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Small HTTP Server version 3.06.36 due to an unquoted service path for the executable 'http.exe service'. This misconfiguration enables local attackers to place a malicious executable with the same name in a higher priority directory, leading the service to execute the harmful file instead of the legitimate one. Exploitation of this vulnerability could result in arbitrary code execution, unauthorized system access, or disruption of the service.

Impact

Exploitation of this vulnerability could allow local attackers to execute arbitrary code, gain unauthorized access to the system, or disrupt the service.

Remediation

Users are advised to update to Small HTTP Server version 3.06.38, ensure that service paths are properly quoted, and restrict physical and network access to the system.