Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-67487

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9c8b17b9eae2704a4e84d67b5f8f62309e44d27dbe20b7f861146f41fcb504ce
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"static-web-server","vendor":"static-web-server","versions":[{"status":"affected","version":"< 2.40.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.5,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-61","description":"CWE-61: UNIX Symbolic Link (Symlink) Following","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/static-web-server/static-web-server/commit/308f0d26ceb9c2c8bd219315d0f53914763357f2","tags":["x_refsource_MISC"],"url":"https://github.com/static-web-server/static-web-server/commit/308f0d26ceb9c2c8bd219315d0f53914763357f2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/cna/references/1
{"name":"https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm","tags":["x_refsource_CONFIRM"],"url":"https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/static-web-server/static-web-server/security/advisories/GHSA-459f-x8vq-xjjm"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:950fbbb12637a7655e088c0132f84d52f53d0ac86132e7f4b9700af7a4a1a97d · sha256:92108836f701e66e… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer