CVE-2026-72570 in directory-serve
Summary
by MITRE • 08/10/2026
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. The lib/helper/html.js file does not sanitize filenames before embedding them in HTML templates at line 28, enabling script execution in other users' browsers when they view the file listing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This stored cross-site scripting vulnerability exists within the cube-root/directory-serve web application version 1.3.7 and earlier, representing a critical security flaw that enables persistent malicious code execution in victim browsers. The vulnerability stems from inadequate input sanitization practices within the application's file handling mechanism, specifically in how filenames are processed and rendered within HTML interfaces. Attackers can exploit this weakness by uploading files with specially crafted filenames containing HTML attribute-breaking characters such as quotes, angle brackets, or script tags that bypass normal validation checks.
The technical implementation of this vulnerability occurs in the lib/helper/html.js file where the application fails to properly sanitize user-supplied filenames before incorporating them into HTML templates. At line 28 of this helper module, filenames are directly embedded into web page content without appropriate escaping or encoding mechanisms, creating an environment where malicious JavaScript code can be injected and executed. This stored nature of the vulnerability means that once a malicious file is uploaded and the filename is rendered in the directory listing interface, any user who views that listing will execute the injected script within their browser context, regardless of whether they interact with the malicious file directly.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with persistent access to victim browsers through the stored XSS vector. When other users browse the directory listing containing the malicious filename, their browsers will execute the embedded JavaScript code, potentially allowing attackers to steal session cookies, perform actions on behalf of users, redirect traffic, or even establish further attack vectors such as credential harvesting or browser fingerprinting. This makes the vulnerability particularly dangerous in multi-user environments where multiple individuals may access the same directory listing interface.
This vulnerability maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to sanitize user input before including it in web page content. The attack pattern aligns with ATT&CK technique T1566.001: Phishing via Social Media, as attackers can craft malicious filenames that appear legitimate while containing embedded scripts. Additionally, this weakness demonstrates characteristics of T1059.007: Command and Scripting Interpreter: JavaScript, as the payload executes within the victim's browser environment using JavaScript execution contexts. The vulnerability also relates to T1213.002: Data from Information Repositories: Web Application Files, indicating that attackers can gain access to stored data through compromised web interfaces.
Mitigation strategies should focus on implementing proper input sanitization and output encoding mechanisms throughout the application's file handling pipeline. All user-supplied filenames must be properly escaped before rendering in HTML contexts using appropriate encoding functions such as HTML entity encoding or context-appropriate escaping methods. The application should implement a comprehensive whitelist-based filename validation system that rejects potentially dangerous characters and patterns while allowing legitimate file naming conventions. Additionally, implementing Content Security Policy headers can provide an additional layer of protection by restricting script execution within the browser environment, preventing malicious scripts from executing even if they are successfully injected. Regular security audits of HTML rendering components and input validation mechanisms should be conducted to identify similar vulnerabilities in other parts of the application codebase.
The vulnerability demonstrates a classic failure in secure coding practices where the principle of least privilege is not properly enforced during data processing. Proper implementation would require that all user input undergoes appropriate sanitization before being processed for web output, following established security frameworks such as OWASP's Secure Coding Practices and the Defense in Depth security model. Organizations should implement automated testing procedures including dynamic application security testing tools that can detect XSS vulnerabilities during development cycles to prevent similar issues from reaching production environments.