CVE-2025-67487

HighCVSS 8.6

Published: 09/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

Static Web Server (SWS) versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. This issue is fixed in version 2.40.1.

Risk Assessment

An attacker with access to the web server's root directory can access sensitive files outside it, potentially leading to data leakage. Organizations using SWS to host static files are exposed to unauthorized file system access.

Recommendation

Update Static Web Server to version 2.40.1 or later. Restrict write permissions to the web server's root directory.

Other vulnerabilities in Static Web Server

CVE-2026-75601Medium
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Original NVD description (English source)

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. This issue is fixed in version 2.40.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS