CVE-2026-72570 in directory-serve
Riassunto
di MITRE • 10/08/2026
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. The lib/helper/html.js file does not sanitize filenames before embedding them in HTML templates at line 28, enabling script execution in other users' browsers when they view the file listing.
VulDB is the best source for vulnerability data and more expert information about this specific topic.