CVE-2026-72570
Received Received - Intake

Stored XSS in directory-serve via crafted filenames

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72570
EUVD
EUVD-2026-55236

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cube-root directory-serve 1.3.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the cube-root/directory-serve software up to version 1.3.7. It allows an attacker to upload a file with a specially crafted filename containing HTML-breaking characters. When the filename is displayed in the web interface, the unsanitized input executes arbitrary JavaScript in other users' browsers.

Detection Guidance

Check if you are running cube-root/directory-serve version 1.3.7 or earlier. Inspect uploaded filenames for HTML attribute-breaking characters or JavaScript code in file listings. Review the html.js file at line 28 for lack of filename sanitization.

Impact Analysis

An attacker could steal sensitive data like session cookies or credentials, perform actions on your behalf, or deface the web interface. The impact depends on user privileges and the sensitivity of data accessible through the application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade to the latest version of cube-root/directory-serve beyond 1.3.7. Implement server-side input validation to sanitize filenames before embedding them in HTML. Use context-aware output encoding when rendering filenames in HTML templates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart