What is the CVSS score of CVE-2026-72569?

CVE-2026-72569 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of directory-serve are affected by CVE-2026-72569?

The cube-root/directory-serve Node.js utility contains a critical vulnerability enabling unauthenticated attackers to delete arbitrary files on affected servers, with all versions through 1.3.7…. A patch is available.

How to fix or mitigate CVE-2026-72569?

Within 24 hours, inventory all applications running cube-root/directory-serve versions 1.3.7 and earlier with the --delete flag enabled, and immediately disable the --delete option as an interim mitigation. Within 7 days, implement network-level access controls (firewall rules, WAF policies, or service mesh controls) restricting remote access to directory-serve endpoints, and audit application and system logs for evidence of unauthorized file deletions or access attempts. Within 30 days, develop and execute a plan to remove cube-root/directory-serve from affected systems entirely or migrate to alternative file-serving solutions, verify that no upstream dependencies transitively pull this package, and document any retained deployments with compensating controls in security architecture.

directory-serve CVE-2026-72569

EUVD-2026-55237 CRITICAL

Path Traversal (CWE-22)

2026-08-10 TuranSec

GHSA-gqqc-7rm5-p6gm

Path Traversal Directory Serve

9.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Remote unauthenticated traversal (AV:N/PR:N/UI:N); low complexity once --delete is enabled; arbitrary file deletion gives I:H/A:H with no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:19 vuln.today

CVE Published

Aug 10, 2026 - 10:40 cve.org

CRITICAL 9.1

DescriptionCVE.org

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.

AnalysisAI

Arbitrary file deletion in the cube-root/directory-serve Node.js utility (all versions through 1.3.7) lets an unauthenticated remote attacker remove files anywhere on the host by supplying ../ sequences in the file query parameter of the file-remove middleware. Exploitation requires the server to be started with the --delete option, and the CVSS 3.1 score of 9.1 (I:H/A:H) reflects the potential for destruction of configuration, data, or system files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially reproducible from the disclosed source path.

Technical ContextAI

directory-serve is a lightweight command-line tool that exposes a local directory over HTTP, and its optional file-management feature is implemented in lib/middleware/file-remove.js. The vulnerability is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the middleware takes the attacker-controlled req.query.file value and concatenates it into a filesystem path passed to a delete operation without canonicalizing or validating that the result stays within the intended served directory. Because Node's path/fs APIs will resolve ../ segments against the base directory, an attacker can escape the web root and reference arbitrary absolute or relative locations. The affected component is identified by CPE cpe:2.3:a:cube-root:directory-serve:*:*:*:*:*:*:*:* covering all releases up to and including 1.3.7.

RemediationAI

No vendor-released patch version is identified at time of analysis, so the primary compensating control is to stop running directory-serve with the --delete option, which removes the vulnerable code path entirely and only costs the file-deletion feature. If deletion functionality is required, restrict network exposure by binding the service to localhost or placing it behind an authenticated reverse proxy and firewalling the listening port so only trusted clients can reach it, accepting the trade-off of reduced accessibility. Additionally run the tool as an unprivileged user in a chrooted or containerized directory so a traversal cannot reach sensitive files outside the intended root. Monitor the project repository (https://github.com/cube-root/directory-serve) for a patched release that canonicalizes and validates the file parameter, and upgrade to it once published; do not rely on an assumed fix version, as none is confirmed in the input data.