EUVD-2026-55236
GHSA-g77q-hxjf-7mcc
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Upload access (PR:L) and victim page-view (UI:R) required; stored XSS crosses browser context (S:C) with limited session/data impact but no availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. The lib/helper/html.js file does not sanitize filenames before embedding them in HTML templates at line 28, enabling script execution in other users' browsers when they view the file listing.
AnalysisAI
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.
Technical ContextAI
directory-serve (cpe:2.3:a:cube-root:directory-serve:*:*:*:*:*:*:*:*) is a Node.js file-serving utility by cube-root. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The affected code path is lib/helper/html.js line 28, which constructs HTML for a file listing by embedding the raw filename string into an HTML template without escaping or sanitizing HTML metacharacters. An attacker who can upload a file - such as one named '><img src=x onerror=alert(1)>.txt' - can break out of HTML attribute context and inject arbitrary script content. Because the payload is stored server-side and rendered to every user who views the listing, this is a persistent (stored) XSS rather than a reflected variant.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the references point only to the upstream GitHub repository without a tagged fix release. The definitive fix is to apply proper HTML entity encoding to filenames before embedding them in HTML templates in lib/helper/html.js line 28, using a library such as he or the native HTML escaping utilities available in the Node.js ecosystem. As a compensating control, operators can restrict file upload access to fully trusted users only, significantly limiting the attacker population. Alternatively, deploying the tool behind an authentication layer that prohibits untrusted parties from uploading files removes the primary exploitation prerequisite. Serving the file listing with a Content-Security-Policy header that blocks inline scripts (script-src 'self') would mitigate the impact of any injected payload, though it does not eliminate the underlying injection flaw. Monitor the upstream repository at https://github.com/cube-root/directory-serve for a patched release.
More in Directory Serve
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today