CVE-2026-72570: Directory-Serve Stored XSS Vulnerability

CVE-2026-72570 Overview

CVE-2026-72570 is a stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through version 1.3.7. The flaw exists in the web interface that renders directory listings of served files. An authenticated attacker can upload a file with a crafted filename containing HTML attribute-breaking characters. When another user views the directory listing, the browser executes the injected JavaScript in the context of the web interface. The issue is tracked under CWE-79 and affects the HTML rendering logic in lib/helper/html.js.

Critical Impact
Attackers with upload access can inject arbitrary JavaScript that runs in the browser session of any user viewing the file directory, enabling session theft, UI redressing, or pivoting to other in-scope origins.

Affected Products

cube-root/directory-serve through version 1.3.7
Node.js applications embedding the vulnerable html.js helper
Any deployment exposing the directory listing web interface to untrusted uploaders

Discovery Timeline

2026-08-10 - CVE-2026-72570 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72570

Vulnerability Analysis

The directory-serve package is a Node.js utility that serves the contents of a local directory over HTTP with a browsable web interface. The interface renders each file entry as HTML, including the raw filename as part of an element attribute. The rendering logic in lib/helper/html.js does not sanitize or encode HTML metacharacters found in filenames.

Because filenames on most operating systems accept characters such as double quotes, angle brackets, and equals signs, an attacker can name a file so that the resulting HTML breaks out of the intended attribute. The escaped context then allows injection of an event handler or a <script> tag. The payload persists on disk and executes for every subsequent viewer of the listing, which classifies the flaw as stored XSS.

Exploitation requires low privileges to upload a file and requires a victim to load the directory listing. The scope changes because injected script runs in the security context of the serving origin.

Root Cause

The root cause is improper neutralization of input during web page generation (CWE-79). The filename value flows from filesystem metadata directly into an HTML attribute without encoding of characters such as ", <, >, and &.

Attack Vector

The attacker uploads a file whose name contains attribute-breaking characters, for example a filename that closes the current attribute and appends an onerror or onmouseover handler with attacker-controlled JavaScript. The directory-serve interface then renders the malicious filename verbatim into the DOM. When a legitimate user browses the directory, the injected handler fires and executes the payload against that user's session. Refer to the directory-serve GitHub repository for source-level context.

Detection Methods for CVE-2026-72570

Indicators of Compromise

Files present on disk whose names contain HTML metacharacters such as ", <, >, onerror=, or onload=
Unexpected outbound requests originating from browsers immediately after loading a directory-serve page
Web server access logs showing directory-listing responses followed by requests to attacker-controlled domains
Unfamiliar accounts or tokens created shortly after users loaded a shared directory listing

Detection Strategies

Scan the served filesystem for filenames matching a regex of HTML-injection patterns, for example [<>"']|on[a-z]+=
Compare rendered HTML output of the directory listing against a strict-encoded baseline to detect unescaped filenames
Add a Content Security Policy in report-only mode to surface script-src and inline-handler violations tied to filename injection

Monitoring Recommendations

Log every file upload event with the raw filename and the uploading identity for later review
Alert on filesystem write events where filenames contain non-printable or HTML-special characters
Monitor browser telemetry for anomalous script execution or DOM events on hosts running directory-serve

How to Mitigate CVE-2026-72570

Immediate Actions Required

Restrict access to directory-serve so that only trusted users can upload or write files to the served directory
Do not expose directory-serve instances to the public internet or to shared multi-tenant environments
Audit the served directory and rename or remove any files whose names contain HTML metacharacters
Track upstream updates on the directory-serve repository for a patched release beyond 1.3.7

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-72570. The vulnerable rendering logic resides in lib/helper/html.js. Consult the project repository for the current release status and apply the next version that HTML-encodes filenames before insertion into attributes.

Workarounds

Place directory-serve behind an authenticating reverse proxy that limits uploaders to trusted identities
Enforce a strict server-side filename policy that rejects any upload whose name contains characters outside [A-Za-z0-9._-]
Deploy a Content Security Policy that disallows inline event handlers and inline <script> execution
Run directory-serve bound to 127.0.0.1 and access it only through a controlled tunnel rather than an open network interface

bash

# Example: enforce a safe filename allowlist at the reverse proxy or wrapper layer
# Reject uploads whose filename contains HTML-breaking characters
if echo "$UPLOAD_FILENAME" | grep -Eq '[^A-Za-z0-9._-]'; then
  echo "Rejected: filename contains disallowed characters" >&2
  exit 1
fi

# Example CSP header to blunt XSS impact
# Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'