CVE-2026-72569 in directory-serve
Summary
by MITRE • 08/10/2026
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability resides in the cube-root/directory-serve application version 1.3.7 and earlier, presenting a critical path traversal flaw that enables unauthenticated remote attackers to execute arbitrary file deletion operations beyond the intended served directory boundaries. The issue manifests specifically when the application operates with the --delete command line option, creating a dangerous attack surface where malicious actors can manipulate file system paths through crafted HTTP requests.
The technical root cause stems from inadequate input sanitization within the lib/middleware/file-remove.js middleware component. This middleware directly incorporates the req.query.file parameter into file system path construction without proper validation or sanitization processes. The absence of path normalization and traversal sequence filtering allows attackers to inject ../ sequences that navigate outside the designated serving directory, effectively bypassing access controls and gaining unauthorized deletion privileges.
From an operational perspective, this vulnerability represents a severe security risk that can lead to complete system compromise when exploited by remote attackers. The unauthenticated nature of the exploit means that any external party can potentially leverage this flaw without requiring prior authorization or credentials, making it particularly dangerous in publicly accessible environments. Successful exploitation could result in data loss, service disruption, and potential system instability through deletion of critical application files or system components.
The vulnerability aligns with CWE-22 Path Traversal and maps to ATT&CK technique T1059 Command and Scripting Interpreter, specifically focusing on the manipulation of file system operations through crafted input sequences. Organizations running vulnerable versions should immediately implement mitigations including parameter validation, path normalization, and strict access control enforcement. The recommended approach involves implementing whitelist-based validation for file paths, ensuring absolute path resolution with proper boundary checks, and removing the --delete option from production deployments until proper sanitization mechanisms are implemented.
Security practitioners should consider this vulnerability as a high-priority remediation item requiring immediate attention, particularly in environments where directory-serve applications operate without proper network segmentation or authentication layers. The combination of remote exploitability, unauthenticated access requirements, and potential for system-wide impact makes this vulnerability particularly concerning for enterprise environments where such applications might be deployed without adequate security controls.