I hate to break it to you, but HTTP servers (what is an html server) absolutely can have all manner of fun exploits, like RCE.