See how shttpd compares to other vendors in security performance
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407.
Stack-based buffer overflow in the (1) putdir function in mongoose.c in Mongoose 3.0, (2) putdir function in yasslEWS.c in yaSSL Embedded Web Server (yasslEWS) 0.2, and (3) shttpdputdir function in iodir.c in Simple HTTPD (shttpd) 1.42 allows remote attackers to execute arbitrary code via an HTTP PUT request, as exploited in the wild in 2011.