CVE-2026-72569: directory-serve Path Traversal Vulnerability

CVE-2026-72569 Overview

CVE-2026-72569 is a path traversal vulnerability [CWE-22] in the cube-root/directory-serve Node.js package through version 1.3.7. The flaw resides in the file removal middleware and allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory. Exploitation requires that the application is launched with the --delete option enabled. Because the attack requires no authentication and executes over the network, any exposed instance running with delete functionality is at risk. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-08-10.

Critical Impact
An unauthenticated remote attacker can delete arbitrary files on the host filesystem, causing loss of integrity and availability of application, configuration, and operating system files.

Affected Products

cube-root/directory-serve versions up to and including 1.3.7
Node.js applications embedding the vulnerable file-remove.js middleware
Any deployment invoked with the --delete command-line option

Discovery Timeline

2026-08-10 - CVE-2026-72569 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72569

Vulnerability Analysis

The vulnerability is a classic path traversal weakness in the file deletion handler of directory-serve. When the utility runs with the --delete flag, it exposes an HTTP endpoint that accepts a filename parameter and passes it to filesystem removal routines. The middleware in lib/middleware/file-remove.js does not adequately normalize or validate the supplied path against the intended base directory. As a result, attackers can supply traversal sequences such as ../ to escape the served directory and target files elsewhere on the host.

The issue affects confidentiality minimally, but it grants full integrity and availability impact. Deleting authentication files, configuration data, or Node.js runtime dependencies can render systems inoperable or force fail-open behavior in downstream services. See the File Remove Middleware source for the affected implementation.

Root Cause

The root cause is insufficient input sanitization on user-supplied path parameters. The middleware fails to canonicalize the resolved path and verify that it remains within the served root directory before invoking the deletion operation. This is a textbook [CWE-22] violation where relative path components are treated as valid file references.

Attack Vector

The attacker sends a crafted HTTP request to the delete endpoint of a directory-serve instance running with --delete. The request includes a filename parameter containing directory traversal sequences pointing outside the served directory. Because the service is unauthenticated, any network-reachable client can issue the request. Successful requests result in the immediate removal of the targeted file with the privileges of the Node.js process.

No public proof-of-concept exploit code is currently available. The EPSS probability for this CVE is 0.514%. Refer to the Directory Serve repository for further technical context.

Detection Methods for CVE-2026-72569

Indicators of Compromise

HTTP requests to directory-serve delete endpoints containing ../, ..%2f, or encoded traversal sequences in filename parameters
Unexpected deletions of files outside the served directory, especially configuration or credential files
Node.js process log entries showing unlink or fs.rm calls targeting paths outside the working directory

Detection Strategies

Inspect web server and reverse proxy logs for DELETE or POST requests to the file-remove endpoint with suspicious path parameters
Deploy filesystem integrity monitoring on hosts running directory-serve to alert on unauthorized file removal
Correlate process telemetry from the Node.js runtime with inbound HTTP requests to detect anomalous deletion patterns

Monitoring Recommendations

Enable audit logging (auditd on Linux) for unlink, unlinkat, and rmdir syscalls on hosts running the application
Monitor for spikes in 200-response deletion requests originating from external IP addresses
Alert on any invocation of directory-serve with the --delete flag in production environments

How to Mitigate CVE-2026-72569

Immediate Actions Required

Stop any directory-serve process running with the --delete option until a patched release is available
Restrict network access to the service using firewall rules or reverse-proxy authentication
Inventory internal hosts and developer workstations for installations of cube-root/directory-serve at or below version 1.3.7

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for CVE-2026-72569. Monitor the cube-root/directory-serve repository for updated releases beyond 1.3.7 that address the path traversal in lib/middleware/file-remove.js.

Workarounds

Run directory-serve without the --delete flag to disable the vulnerable endpoint entirely
Bind the service to 127.0.0.1 or an internal interface only, preventing external network access
Place the service behind an authenticated reverse proxy that filters requests containing traversal sequences
Run the Node.js process under a low-privilege user account with read-only access to sensitive directories

bash

# Configuration example: run without delete and bind to localhost only
directory-serve --host 127.0.0.1 --port 8080 /path/to/served/dir

# Reverse proxy filter (nginx) blocking traversal sequences
location / {
    if ($request_uri ~* "\.\./|\.\.%2f|%2e%2e/") {
        return 403;
    }
    proxy_pass http://127.0.0.1:8080;
}