CVE-2026-72570: cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cube-root/directory-serveto a version that resolves this vulnerability.Fixed in 1.3.7 - Configuration
In lib/helper/html.js, sanitize or HTML-escape filenames before embedding them in the HTML templates (the code at line 28 currently does not sanitize filenames), to prevent stored XSS from crafted filenames.
cube-root/directory-serve (lib/helper/html.js) filename sanitization before HTML templating (at line 28) = Enable sanitization/escaping of HTML attribute-breaking characters prior to embedding filenames into HTML templates - Compensating control
Mitigate exposure by restricting access to the directory-serve web interface and limiting which users can view file listings until the filename sanitization fix is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72570?
The severity of CVE-2026-72570 is rated as medium with a score of 5.4.
How do I fix CVE-2026-72570?
Fix CVE-2026-72570 by updating to the latest version of cube-root/directory-serve that addresses the stored XSS vulnerability.
What type of vulnerability is CVE-2026-72570?
CVE-2026-72570 is a stored cross-site scripting (XSS) vulnerability.
What impact does CVE-2026-72570 have on web applications?
CVE-2026-72570 allows an attacker to inject arbitrary JavaScript into the web interface, potentially compromising user data.
In which versions of cube-root/directory-serve is CVE-2026-72570 present?
CVE-2026-72570 is present in cube-root/directory-serve version 1.3.7.