CVE-VINEXT-CIVETWEB-PUT-SSI-RCE: CivetWeb PUT + SSI #exec RCE

CivetWeb combines an authenticated HTTP PUT upload feature with Server-Side Include (SSI) #exec processing. When an administrator enables put_delete_auth_file (Digest authentication for PUT/DELETE), any authenticated user can upload a file ending in .shtml via PUT. Because the default ssi_pattern includes **.shtml$ and **.shtm$, a subsequent GET request causes do_ssi_exec() to pass the command to popen(). The result is authenticated remote code execution. Reproduction: build CivetWeb from https://github.com/civetweb/civetweb at commit 588860e3, start with listening_ports, document_root, and put_delete_auth_file, create a digest password file, then PUT a file such as /pwn.shtml containing , and GET /pwn.shtml to see the command output. The issue is enabled by the interaction of two default/documented features; no out-of-band interaction is required.