High severity7.8NVD Advisory· Published Apr 21, 2026· Updated Apr 22, 2026
CVE-2026-5789
CVE-2026-5789
Description
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
Affected products
1- cpe:2.3:a:civetweb_project:civetweb:1.16:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- www.incibe.es/en/incibe-cert/notices/aviso/search-path-without-quotes-civetwebnvdThird Party Advisory
News mentions
0No linked articles in our index yet.