CVE-2026-5789
Search path without quotes in CivetWeb
Summary
Search path without quotes in CivetWeb
Original description
The description as published by the source.
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2026-5789 civetweb
References
- advisory github.com
- advisory nvd.nist.gov
- patch incibe.es