CVE-2026-5789: 
NixOS vulnerability analysis and mitigation

CVE-2026-5789 is an unquoted search path vulnerability (CWE-428) in CivetWeb v1.16 that allows a local attacker with low privileges to execute arbitrary code with elevated privileges. The flaw exists because the Windows service configuration references the executable path C:\Program Files\CivetWeb\CivetWeb.exe -- without enclosing quotes, enabling Windows path resolution abuse. It was disclosed on April 21, 2026, by Spain's National Cybersecurity Institute (INCIBE) and assigned a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, INCIBE Advisory).

The root cause is CWE-428 (Unquoted Search Path or Element): when a Windows service executable path contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the path by testing each space-delimited segment as a potential executable. For the path C:\Program Files\CivetWeb\CivetWeb.exe, Windows will first attempt to execute C:\Program.exe, then C:\Program Files\CivetWeb.exe, before reaching the intended binary. An attacker with write access to any of these intermediate directories can place a malicious executable (e.g., Program.exe) that will be executed instead. Exploitation requires only low-privilege local access and no user interaction, and is triggered when the CivetWeb service is restarted (GitHub Advisory, INCIBE Advisory).

Successful exploitation results in arbitrary code execution with the elevated privileges of the CivetWeb Windows service, leading to high impact on confidentiality, integrity, and availability of the affected system. An attacker can achieve full system compromise, including credential theft, data exfiltration, installation of persistent backdoors, or disruption of service. Because the malicious code runs with service-level (potentially SYSTEM) privileges, the attacker can bypass standard user-level access controls and potentially pivot to other systems on the network (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.014–0.017%, placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify Windows systems running CivetWeb v1.16 as a service. Use tools like sc query or wmic service get name,pathname to enumerate service configurations and confirm the unquoted path.
2. Verify vulnerable path: Confirm the service binary path is C:\Program Files\CivetWeb\CivetWeb.exe -- (unquoted) by running sc qc CivetWeb and inspecting the BINARY_PATH_NAME field.
3. Identify writable directory: Determine which intermediate path segment is writable by the attacker (e.g., C:\Program.exe requires write access to C:\, or C:\Program Files\CivetWeb.exe requires write to C:\Program Files\). Use icacls to check permissions.
4. Place malicious executable: Copy or create a malicious executable (e.g., a reverse shell payload) at the exploitable path (e.g., C:\Program.exe or C:\Program Files\CivetWeb.exe).
5. Trigger service restart: Wait for or trigger a service restart via system reboot, service failure recovery, or if the attacker has SeShutdownPrivilege, by running sc stop CivetWeb && sc start CivetWeb.
6. Achieve elevated code execution: When the service restarts, Windows executes the malicious binary with the service's elevated privileges, granting the attacker a privileged shell or persistent access (INCIBE Advisory, GitHub Advisory).

• Process: Unexpected processes (e.g., Program.exe, CivetWeb.exe in non-standard directories) spawned with SYSTEM or service-account privileges; child processes of services.exe that are not the legitimate CivetWeb binary.
• File System: Presence of unexpected executables at paths such as C:\Program.exe, C:\Program Files\CivetWeb.exe (outside the actual install directory), or other intermediate path segments; modification timestamps on files in C:\Program Files\ or root C:\ by non-administrative accounts.
• Logs: Windows Event Log (System) entries showing service start/stop events for CivetWeb (Event ID 7036) followed by unusual process creation events (Event ID 4688) for unexpected executables; Security log entries showing privilege escalation or new process creation under SYSTEM context.
• Registry: Changes to the service registry key HKLM\SYSTEM\CurrentControlSet\Services\CivetWeb\ImagePath indicating path modification.

The primary remediation is to update CivetWeb from v1.16 to a patched version that correctly quotes the service executable path (GitHub Advisory). As an interim workaround, administrators can manually correct the service configuration by enclosing the path in quotes: update the ImagePath registry value at HKLM\SYSTEM\CurrentControlSet\Services\CivetWeb to "C:\Program Files\CivetWeb\CivetWeb.exe". Additionally, restrict write permissions on C:\ and C:\Program Files\ to authorized administrators only using icacls, and audit all service binary paths on Windows systems using wmic service get name,pathname | findstr /i /v "\"" to identify other unquoted paths (INCIBE Advisory).

The vulnerability was reported and assigned by INCIBE (Spain's National Cybersecurity Institute), which published an advisory on April 21, 2026. Red Hat tracked the issue via Bugzilla (Bug 2460124) and classified it as high severity. Tenable published a Nessus detection plugin (310812) for the vulnerability. No significant broader community debate or notable researcher commentary has been identified beyond standard vulnerability database aggregation (INCIBE Advisory, Red Hat Bugzilla).