ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67487

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets.

Published Dec 9, 2025 · updated Oct 14, 2026 · static-web-server static web server

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s root directory, they could create symlinks to access other files outside the designated web root folder either by URL or via the directory listing. This issue is fixed in version 2.40.1.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 9, 2025 · NIST NVD

    Detected

    Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s roo

  2. Oct 14, 2026 · NIST NVD

    Updated

    Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent symlinks from escaping the web server’s root directory. Therefore, if a malicious actor gains access to the web server’s roo

Affected

  • cpe static-web-server/static web serverversion unspecified

Sources

  • CVE.orgCVE-2025-67487

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-67487

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDCVE-2025-67487

    Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to access files or directories outside the intended web root folder. SWS generally does not prevent syml

    nvd.nist.gov

References