GHSA-54m3-5fxr-2f3j
8.8
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
Low
Lifecycle Timeline
4
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Mar 05, 2026 - 17:42 vuln.today
Public exploit code
Patch Released
Mar 05, 2026 - 17:42 nvd
Patch available
CVE Published
Jan 08, 2026 - 19:16 nvd
HIGH 8.8
DescriptionNVD
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.
AnalysisAI
Salvo is a Rust web backend framework. [CVSS 8.8 HIGH]
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).