CVE-2018-18778: ACME mini_httpd arbitrary file read via path handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityArbitrary file read with a very high EPSS score and no KEV listing, on an internet-reachable service, warrants prompt patching despite the medium CVSS base score.

What it is

ACME mini_httpd before version 1.30 allows remote users to read arbitrary files. The flaw is an information exposure issue (CWE-200) in the web server's file handling, meaning files outside the intended document root can be retrieved. Because mini_httpd is a small, widely embedded HTTP server, exposed instances risk leaking configuration, credential or other sensitive files.

Impact

An attacker gains read access to arbitrary files on the host filesystem that the server process can read, potentially exposing credentials, configuration and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to the mini_httpd service (AV:N). The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so the attacker needs some level of access or an authenticated context rather than being fully anonymous.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.708 probability, 99.4th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade mini_httpd to version 1.30 or later, which is the fixed release per the advisory.
• If upgrade is not immediately possible, restrict network access to the mini_httpd service with firewall rules or bind it to trusted interfaces only.
• Run the service under a least-privilege account so arbitrary file reads are limited to non-sensitive paths.
• Audit the document root and file permissions to reduce exposure of sensitive files to the server process.

Detection

• Monitor HTTP request logs for path traversal patterns such as ../ sequences or encoded variants targeting files outside the document root.
• Alert on requests for sensitive filenames (e.g. configuration, password or key files) served by mini_httpd.
• Baseline normal request paths and flag anomalous file requests returning 200 responses for unexpected resources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.