A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).
References
| Link | Resource |
|---|---|
| https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f | Exploit Third Party Advisory |
| https://github.com/svenstaro/miniserve | Product |
Configurations
History
11 Feb 2026, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:svenstaro:miniserve:0.32.0:*:*:*:*:*:*:* | |
| References | () https://gist.github.com/thesmartshadow/55688f87f8b985eb530e07d00ef8c63f - Exploit, Third Party Advisory | |
| References | () https://github.com/svenstaro/miniserve - Product | |
| First Time |
Svenstaro
Svenstaro miniserve |
23 Jan 2026, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-59 CWE-367 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.8 |
23 Jan 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-23 16:15
Updated : 2026-02-11 19:45
NVD link : CVE-2025-67124
Mitre link : CVE-2025-67124
CVE.ORG link : CVE-2025-67124
JSON object : View
Products Affected
svenstaro
- miniserve