Static-web-server vulnerabilities

Products

• Static-web-server 4
• Static Web Server 2

Newest

• static-web-server Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled CVE-2026-75601 4.3 MediumAugust 26, 2026
• static-web-server static web server, static-web-server +1 more Static Web Server: Timing-Based Username Enumeration in Basic Authentication CVE-2026-27480 Fix available 5.3 MediumFebruary 20, 2026
• static-web-server static web server, static-web-server +1 more Static Web Server is vulnerable to symbolic link Path Traversal CVE-2025-67487 Fix available 5.5 MediumDecember 8, 2025
• static-web-server Stored Cross-site Scripting in directory listings via file names in static-web-server CVE-2024-32966 Fix available 5.8 MediumMay 1, 2024