Executive brief
directory-serve is a CLI tool for sharing files over a network. A stored XSS vulnerability allows attackers to inject malicious JavaScript into the web interface by uploading files with specially crafted filenames, potentially compromising users who access the file listing and stealing their session data or performing actions on their behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in directory-serve through version 1.3.7 in the file listing display functionality. The vulnerability occurs because filenames are not properly sanitized before being inserted into HTML attributes. An attacker can upload a file with a malicious filename containing HTML attribute-breaking characters (e.g., quotes and angle brackets) to inject arbitrary JavaScript code. When other users view the directory listing, the payload executes in their browser context, allowing session hijacking or further attacks. No authentication is required to upload files; patches should be applied to sanitize filenames or properly escape them when rendering in HTML.
Affected products
- cube-root directory-serve through 1.3.7
Timeline
- 2026-08-10: disclosed