CVE-2026-73259: Mongoose: Reflected XSS via decoded URI in directory listing render
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.22
Event History
Frequently Asked Questions
Which deployments are exposed?
Mongoose deployments that use directory listings with MG_ENABLE_DIRLIST enabled are affected if they run a version before 7.22. The vulnerable behavior is in the directory-serving path used by mg_http_serve_dir() and listdir().
What is required to exploit this issue?
An attacker can remotely submit a crafted percent-encoded request path, but a user must then be persuaded to visit the resulting page. No attacker authentication is required.
What is the available fix?
Upgrade Mongoose to version 7.22, which fixes the issue. The fix addresses unencoded decoded request URI content rendered in directory listing title and h1 elements.