CVE-2026-73259
Received Received - Intake

Mongoose Web Server Directory Listing XSS via Percent-Encoded Path

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73259
EUVD
EUVD-2026-63498

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose 7.22
cesanta mongoose to 7.22 (exc)
cesanta mongoose 7.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73259 is a reflected Cross-Site Scripting (XSS) vulnerability in the Mongoose web server library affecting version 7.21. When directory listing is enabled, the server decodes percent-encoded request paths and injects them into HTML elements without proper encoding. This allows attackers to inject malicious JavaScript via crafted URIs.

Detection Guidance

To detect this vulnerability, check if your Mongoose server is running version 7.21 or earlier with MG_ENABLE_DIRLIST enabled. Test by sending a crafted request like GET /subdir/%3Cimg%20src=x%20onerror=alert(1)%3E/ and observe if the response contains the injected script in the title or h1 elements.

Impact Analysis

An attacker can trick a user into clicking a malicious link, executing arbitrary JavaScript in the victim's browser. This could expose session data, perform unauthorized actions on behalf of the user, or manipulate displayed content. The attack requires user interaction and does not need server write access.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance risks if exploited.

Mitigation Strategies

Upgrade Mongoose to version 7.22 or later. If upgrading is not immediately possible, disable directory listing by setting MG_ENABLE_DIRLIST to 0 or disable the feature in your configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart