Directory Serve
Monthly
Arbitrary file deletion in the cube-root/directory-serve Node.js utility (all versions through 1.3.7) lets an unauthenticated remote attacker remove files anywhere on the host by supplying ../ sequences in the file query parameter of the file-remove middleware. Exploitation requires the server to be started with the --delete option, and the CVSS 3.1 score of 9.1 (I:H/A:H) reflects the potential for destruction of configuration, data, or system files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially reproducible from the disclosed source path.
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.
Arbitrary file deletion in the cube-root/directory-serve Node.js utility (all versions through 1.3.7) lets an unauthenticated remote attacker remove files anywhere on the host by supplying ../ sequences in the file query parameter of the file-remove middleware. Exploitation requires the server to be started with the --delete option, and the CVSS 3.1 score of 9.1 (I:H/A:H) reflects the potential for destruction of configuration, data, or system files. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially reproducible from the disclosed source path.
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.