CVE-2026-72569: cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cube-root/directory-serveto a version that resolves this vulnerability.Fixed in 1.3.7 - Configuration
Run cube-root/directory-serve without the --delete option to prevent arbitrary file deletion via path traversal.
cube-root directory-serve --delete option = disable - Compensating control
Ensure only trusted/allowed clients can reach cube-root/directory-serve (e.g., restrict network access/ingress to the service) since the issue is exploitable by an unauthenticated remote attacker.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72569?
The severity of CVE-2026-72569 is critical with a CVSS score of 9.1.
How do I fix CVE-2026-72569?
To mitigate CVE-2026-72569, avoid using the --delete option in cube-root/directory-serve until a patched version is released.
What type of vulnerability is CVE-2026-72569?
CVE-2026-72569 is classified as a path traversal vulnerability.
Who is affected by CVE-2026-72569?
Any user running version 1.3.7 of cube-root/directory-serve with the --delete option enabled is at risk from CVE-2026-72569.
What can an attacker do with CVE-2026-72569?
An unauthenticated remote attacker can delete arbitrary files outside the intended directory due to CVE-2026-72569.