static-web-server
A cross-platform, high-performance and asynchronous web server for static files-serving. ⚡
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 43
- Cadence
- ~26 days
- Last 12 months
- 8
Reach
- Downloads
- 45.2k
- Stars
- 2.3k
Details
- License
- MIT OR Apache-2.0
- First release
- Apr 13, 2023
| Version | Released | |
|---|---|---|
2.44.0
minor
|
2.44.0
minor
Dependencies (48)
+ 40 more
Changelog
Compare changes
|
|
3.0.0-beta.1
pre
|
3.0.0-beta.1
pre
Dependencies (58)
+ 50 more
Changelog
Compare changes
|
|
2.43.0
minor
|
2.43.0
minor
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
2.42.0
minor
|
2.42.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.41.0
minor
|
2.41.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.40.1
patch
1 CVE
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev |
2.40.1
patch
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.40.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.40.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.39.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.39.0
minor
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
2.38.1
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.38.1
patch
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
2.38.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.38.0
minor
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
2.37.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.37.0
minor
Dependencies (46)
+ 38 more
Changelog
Compare changes
|
|
2.36.1
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.36.1
patch
Dependencies (48)
+ 40 more
Changelog
Compare changes
|
|
2.36.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.36.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.35.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.35.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.34.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.34.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.33.1
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.33.1
patch
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.33.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.33.0
minor
Dependencies (45)
+ 37 more
Changelog
Compare changes
|
|
2.32.2
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.32.2
patch
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
2.32.1
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.32.1
patch
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
2.32.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.32.0
minor
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
2.31.1
patch
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.31.1
patch
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
2.31.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.31.0
minor
Dependencies (42)
+ 34 more
Changelog
Compare changes
|
|
2.30.0
minor
2 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev |
2.30.0
minor
Dependencies (41)
+ 33 more
Changelog
Compare changes
|
|
2.28.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.28.0
minor
Dependencies (39)
+ 31 more
Changelog
Compare changes
|
|
2.27.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.27.0
minor
Dependencies (39)
+ 31 more
Changelog
Compare changes
|
|
2.26.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.26.0
minor
Dependencies (39)
+ 31 more
Changelog
Compare changes
|
|
2.25.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.25.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.24.2
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.24.2
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.24.1
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.24.1
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.24.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.24.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.23.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.23.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.22.1
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.22.1
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.22.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.22.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.21.1
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.21.1
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.21.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.21.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.20.2
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.20.2
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.20.1
patch
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.20.1
patch
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.20.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.20.0
minor
Dependencies (37)
+ 29 more
Changelog
Compare changes
|
|
2.19.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.19.0
minor
Dependencies (35)
+ 27 more
Changelog
Compare changes
|
|
2.18.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.18.0
minor
Dependencies (35)
+ 27 more
Changelog
Compare changes
|
|
2.17.0
minor
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.17.0
minor
Dependencies (35)
+ 27 more
Changelog
Compare changes
|
|
2.16.0
initial
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.16.0
initial
Dependencies (35)
+ 27 more
Changelog
Compare changes
|
|
2.15.1-beta.0
pre
3 CVEs
CVE-2026-27480
GHSA-qhp6-635j-x7r2
Feb 20, 2026
Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
SummaryA Timing-based username enumeration in Basic Authentication vulnerability due to early response on invalid usernames could allow attackers to identify valid users and focus their efforts on targeted brute-force or credential-stuffing attacks. DetailsSWS validates the provided username before performing any password verification.
This allows an attacker to distinguish between existing and non-existing accounts by analyzing response times. PoCThe following statistical results were obtained by measuring the mean response time over 100 iterations using a custom Rust script: | User Type | Average Response Time | | :--- | :--- | | Invalid User | 0.409861 ms | | Valid User | 0.250925 ms | | Difference | ~0.158936 ms | While the valid user responded faster in this specific test environment, the statistically significant gap confirms that the authentication logic does not execute in constant time. ImpactUsers using the SWS' Basic Authentication feature are primarily impacted. Fixed in
2.41.0
References
Updated Feb 23, 2026 · Source: OSV.dev
CVE-2025-67487
GHSA-459f-x8vq-xjjm
Dec 08, 2025
Static Web Server vulnerable to a symbolic link path traversal
Medium
Network
Low
None
None
SummarySymbolic links (symlinks) could be used to access files or directories outside the intended web root folder. DetailsSWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. PoC
ImpactAny web server that runs with elevated privileges (e.g., root/administrator) and handles user-supplied file uploads is primarily impacted. Fixed in
2.40.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2024-32966
GHSA-rwfq-v4hq-h7fg
May 01, 2024
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
5.8
/ 10
Medium
Network
High
None
Required
Changed
Low
Low
Low
SummaryIf directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like DetailsSWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least ImpactFor any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored XSS vulnerability. Fixed in
2.30.0
References Updated May 01, 2024 · Source: OSV.dev |
2.15.1-beta.0
pre
Dependencies (35)
+ 27 more
Changelog
|