CVE-2026-73254: Mongoose: Stored XSS via unescaped filenames in directory listing
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.22 - Configuration
Disable directory listing (MG_ENABLE_DIRLIST) to prevent stored XSS via unescaped filenames when serving directory listings.
Mongoose embedded web server MG_ENABLE_DIRLIST = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when they serve a directory with MG_ENABLE_DIRLIST enabled. The affected directory listing path renders filesystem filenames as HTML link text without escaping them.
What must an attacker and victim do for exploitation to occur?
An attacker must be able to create a file whose filename contains an HTML payload. A user must then browse the affected directory listing, causing the browser to execute the injected markup in the Mongoose origin.
How can I assess whether an instance is affected?
Check whether the Mongoose version is earlier than 7.22 and whether MG_ENABLE_DIRLIST is enabled for served directories. Also determine whether untrusted parties can create files in directories that are exposed through those listings.
What is the available fix?
Upgrade Mongoose to version 7.22, which fixes the issue.