CVE-2026-72569 in directory-serve
Zusammenfassung
von MITRE • 10.08.2026
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.