Home

Description

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.

PUBLISHED Reserved 2026-04-08 | Published 2026-04-21 | Updated 2026-04-21 | Assigner INCIBE




HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-428 Unquoted search path or element

Product status

Default status
unaffected

1.16
affected

Credits

Rafael Pedrero finder

References

www.incibe.es/...s/aviso/search-path-without-quotes-civetweb patch

cve.org (CVE-2026-5789)

nvd.nist.gov (CVE-2026-5789)

Download JSON