CVE-2026-75601

MediumCVSS 4.3

Published: 26/08/2026(UTC)Updated: 09/09/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Risk Assessment

The risk is the disclosure of sensitive operational information (such as host names, request volumes, error rates) to unauthorized parties, which may facilitate further attacks and breach confidentiality.

Recommendation

It is recommended to upgrade Static Web Server to version 2.44.0 or later to ensure the /metrics endpoint is protected by authentication.

Other vulnerabilities in Static Web Server

CVE-2025-67487High
Static Web Server (SWS) versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. This issue is fixed in version 2.40.1.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS