Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
Source: NVD ↗ · CISA KEV Catalog ↗