CVE-2026-73254
Received Received - Intake

Stored XSS in Mongoose Web Server Directory Listing

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73254
EUVD
EUVD-2026-63496

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose 7.22
cesanta mongoose 7.21
cesanta mongoose 7.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Mongoose web server library affecting version 7.21. When directory listing is enabled, Mongoose displays raw filenames in HTML link text without proper encoding. Attackers can create files with malicious filenames containing HTML or JavaScript payloads. When users browse the directory, the browser executes the payload, leading to stored XSS attacks.

Detection Guidance

Check if your Mongoose version is below 7.22 by running: mongoose --version. If MG_ENABLE_DIRLIST is enabled, inspect directory listings for filenames containing HTML or JavaScript payloads like <img src=x onerror=alert(1)>.

Impact Analysis

An attacker could steal session data, perform actions on behalf of the victim, or expose sensitive information. Exploitation requires the attacker to have file creation rights and the server to have directory listing enabled (MG_ENABLE_DIRLIST).

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations.

Mitigation Strategies

Upgrade Mongoose to version 7.22 or later. Disable MG_ENABLE_DIRLIST if directory listing is not required. Sanitize filenames to prevent malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart