CVE-2026-67185 is a path traversal vulnerability in GeneralSandman TinyWeb up to version 0.0.8. The issue arises in the HttpBuilder::buildResponse() function, where URL paths containing '../' sequences are concatenated directly to the configured web root without normalization, dot-segment removal, or boundary validation. This allows attackers to craft requests that bypass URL parsing and reach filesystem calls in HttpFile::setFile(), enabling unauthorized reading of arbitrary files. The vulnerability is exploitable without authentication and can lead to exposure of sensitive files if the server process has elevated privileges.

An attacker can read arbitrary files on the server hosting TinyWeb 0.0.8 without authentication. This can lead to disclosure of sensitive information such as credential stores and private keys, particularly if the server runs as root. The vulnerability poses a high risk to confidentiality but does not indicate impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the TinyWeb server, avoid running the server with root privileges, and monitor for suspicious requests containing path traversal patterns. Do not rely on this as a permanent solution; apply vendor patches once released.