EUVD-2026-24138

ID: EUVD-2026-24138

Severity: high

CVSS v4: 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.

Timestamps

Normalized: 2026-04-21T16:32:19Z UTC
Last updated: 2026-04-21T16:32:19Z UTC

References

No references provided.

VulnAI

EUVD-2026-24138

Description

Timestamps

References