Mongoose EUVD-2026-63498

Two explicit prerequisites must both be satisfied: (1) the target Mongoose server was compiled with the MG_ENABLE_DIRLIST compile-time flag - this is non-default and requires deliberate opt-in at build time, so most Mongoose deployments are not affected; and (2) the attacker must persuade a victim user to visit a crafted URL (UI:R per CVSS). No authentication is required from the attacker (PR:N per the provided CVSS vector). Exploitation is bounded to the Mongoose web origin - scope is unchanged (S:U), so the reflected script cannot directly access cross-origin resources. The most significant limiting factor for defenders is the MG_ENABLE_DIRLIST requirement: inventorying build configurations to confirm whether this flag is in use is the critical triage step before assessing exposure.

The CVSS 3.1 score of 5.4 (Medium) reflects the moderate but real-world constrained nature of this flaw: AV:N/AC:L/PR:N confirm a network-reachable, low-complexity, unauthenticated attack surface, while UI:R and S:U cap the impact by requiring victim interaction and containing blast radius to the Mongoose origin. The confidentiality and integrity impacts (C:L/I:L) correspond to session theft and on-behalf-of actions - meaningful but not catastrophic. No EPSS score was provided, so exploitation probability cannot be quantified; however, the absence of any CISA KEV listing and no known public exploit code meaningfully reduces urgency. The critical risk-reducing factor is the non-default MG_ENABLE_DIRLIST compile-time requirement: only deployments that deliberately enable this flag are exposed, significantly narrowing the attack surface compared to a default-configuration flaw. For affected deployments (especially those exposing directory listings to untrusted networks), the CVSS metrics are accurate and the risk is real.

An attacker discovers a Mongoose-based embedded web interface with MG_ENABLE_DIRLIST compiled in and crafts a URL containing a percent-encoded XSS payload in the path component, such as /%3Cscript%3Ealert(document.cookie)%3C/script%3E. The attacker distributes the link via phishing email or embeds it in a third-party page; when an authenticated victim clicks the link, the Mongoose server decodes the path, inserts it unescaped into the directory listing page's <title> and <h1> elements, and the injected script executes in the victim's browser under the Mongoose origin, exfiltrating session tokens or submitting authenticated requests on their behalf. No public proof-of-concept exploit is identified at time of analysis.