CVE-2026-5789
Civetweb Project Civetweb 1.16
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-5789 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Civetweb Project Civetweb. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5789 is an unquoted search path vulnerability (CWE-428) affecting CivetWeb version 1.16. The issue stems from the service configuration lacking quotes around the executable path "C:\Program Files\CivetWeb\CivetWeb.exe", causing the system to scan preceding directories for matching executables during service startup.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). By placing a malicious executable named CivetWeb.exe in a directory scanned before C:\Program Files\CivetWeb, the attacker achieves arbitrary code execution with elevated privileges, potentially compromising confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS v3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/search-path-without-quotes-civetweb provides details on the vulnerability, including recommendations for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24138
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability Data
Vulnerability related to an unquoted search path in CivetWeb v1.16. This vulnerability allows a local attacker to execute arbitrary code with elevated privileges by placing a malicious executable in a directory that is scanned before the intended application path (C:\Program…
more
Files\CivetWeb\CivetWeb.exe --), due to the absence of quotes in the service configuration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover unquoted search paths through static analysis or dynamic test cases.
Documented development standards and tools can mandate proper quoting and escaping of path elements.
Engineering principles can require safe construction and quoting of search paths and command elements.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent path-handling flaws such as unquoted elements during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect unquoted search-path issues before deployment.
Enforcing controlled software installation can prevent unquoted search-path elements in executables and scripts.
Secure development lifecycle practices include input validation and path handling that reduce unquoted search-path weaknesses.
Secure system architecture and engineering principles require safe path construction and quoting conventions.
Secure coding standards directly mandate quoting search paths and avoiding unsafe path construction.
Change-management processes can enforce review of path-handling changes that might introduce unquoted elements.