Is CVE-2026-73254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73254 being exploited in the wild.

How severe is CVE-2026-73254?

Medium severity, with a CVSS score of 5.4, published 20 August 2026.

Which products and versions are affected?

Cesanta Mongoose prior to 7.22.

Is there a fix for CVE-2026-73254?

A patch was published on 2026-06-23: Fixed in version 7.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73254 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73254?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73254: Cesanta Mongoose stored cross-site scripting in directory listing

CVE-2026-73254 · Severity: medium · CVSS 5.4 · Published 2026-08-20

Mongoose is an embedded web server and network library used in IoT devices and applications. An attacker who can create a file with a specially crafted HTML name can inject malicious code that executes when an administrator or user browses the directory listing. This could allow the attacker to steal session data, perform actions on behalf of the victim, or compromise the system.

Quick answers

Is CVE-2026-73254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73254 being exploited in the wild.
How severe is CVE-2026-73254?: Medium severity, with a CVSS score of 5.4, published 20 August 2026.
Which products and versions are affected?: Cesanta Mongoose prior to 7.22.
Is there a fix for CVE-2026-73254?: A patch was published on 2026-06-23: Fixed in version 7.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73254 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73254?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the directory listing functionality (MG_ENABLE_DIRLIST) in Mongoose prior to version 7.22. The vulnerability is in the printdirentry() function called by listdir() in src/http.c, which URL-encodes the href attribute but fails to properly escape the raw filesystem filename when inserting it into the HTML link text. An attacker who can create a file with an HTML payload in its filename can trigger the injection when the directory is browsed. The malicious script executes in the Mongoose server's origin, potentially exposing session cookies or permitting unauthorized actions. The fix was implemented in version 7.22.

Affected products

Cesanta Mongoose prior to 7.22

Timeline

2026-08-20: disclosed
2026-06-23: patched: Fixed in version 7.22

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.