CVE-2026-5789— Search path without quotes in CivetWeb
Quick assessment
Affected
CivetWeb CivetWeb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CivetWeb是Civetweb开源的一个易于使用、功能强大、可嵌入 C/C++ 的 Web 服务器，具有可选的 CGI、SSL 和 Lua 支持。 CivetWeb v1.16版本存在代码问题漏洞，该漏洞源于服务配置中未加引号的搜索路径，可能导致本地攻击者通过放置恶意可执行文件执行任意代码并提升权限。
Possible ATT&CK Techniques 1 AI
T1546.001 · Change Default File Association
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-5789
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Search path without quotes in CivetWeb
Source: CVE Program / CVE List V5
Vulnerability Description
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经引用的搜索路径或元素
Source: CVE Program / CVE List V5
Vulnerability Title
CivetWeb 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CivetWeb是Civetweb开源的一个易于使用、功能强大、可嵌入 C/C++ 的 Web 服务器，具有可选的 CGI、SSL 和 Lua 支持。 CivetWeb v1.16版本存在代码问题漏洞，该漏洞源于服务配置中未加引号的搜索路径，可能导致本地攻击者通过放置恶意可执行文件执行任意代码并提升权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-5789
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-5789
请登录查看更多情报信息。