Executive brief
Mongoose is an embedded web server and network library used in IoT devices and applications. An attacker who can create a file with a specially crafted HTML name can inject malicious code that executes when an administrator or user browses the directory listing. This could allow the attacker to steal session data, perform actions on behalf of the victim, or compromise the system.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the directory listing functionality (MG_ENABLE_DIRLIST) in Mongoose prior to version 7.22. The vulnerability is in the printdirentry() function called by listdir() in src/http.c, which URL-encodes the href attribute but fails to properly escape the raw filesystem filename when inserting it into the HTML link text. An attacker who can create a file with an HTML payload in its filename can trigger the injection when the directory is browsed. The malicious script executes in the Mongoose server's origin, potentially exposing session cookies or permitting unauthorized actions. The fix was implemented in version 7.22.
Affected products
- Cesanta Mongoose prior to 7.22
Timeline
- 2026-08-20: disclosed
- 2026-06-23: patched: Fixed in version 7.22