CVE-2026-5789: Search path without quotes in CivetWeb

Published Apr 21, 2026

Updated

Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.

Affected Software

2 affected components

CivetWeb CivetWeb=1.16

Civetweb Project Civetweb=1.16

Remediation

Information

No solution has been reported yet.

Event History

Apr 21, 2026

CVE Published

via MITRE·02:22 PM

Data Sourced

via MITRE·02:22 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

May 2, 58290

Event

via FIRST·05:37 PM

Frequently Asked Questions

What is the severity of CVE-2026-5789?

CVE-2026-5789 is considered a high-severity vulnerability due to the potential for local attackers to execute arbitrary code with elevated privileges.

How do I fix CVE-2026-5789?

To fix CVE-2026-5789, it's recommended to upgrade CivetWeb to version 1.17 or later, which resolves the unquoted search path issue.

Who is affected by CVE-2026-5789?

CVE-2026-5789 affects all users running CivetWeb version 1.16.

What types of attacks can exploit CVE-2026-5789?

CVE-2026-5789 can be exploited by local attackers who can place a malicious executable in a directory scanned by the application.

Is there a workaround for CVE-2026-5789?

A potential workaround for CVE-2026-5789 is to ensure that no untrusted executables are placed in directories scanned by CivetWeb.