Description

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. The lib/helper/html.js file does not sanitize filenames before embedding them in HTML templates at line 28, enabling script execution in other users' browsers when they view the file listing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T11:17:29.633Z",
  "pubdate": "2026-08-10T11:17:29.633Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in the cube-root/directory-serve package through version 1.3.7.\nThe flaw allows an authenticated or unauthenticated attacker with file upload capabilities to inject arbitrary JavaScript into the web interface.\nImpact includes the execution of malicious scripts in the browsers of other users who view the affected file listing interface, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.\nThe vulnerability resides in the handling of uploaded filenames, which are directly embedded into HTML templates without proper sanitization.\nRisk implications are significant for deployments exposed to untrusted users who can upload files with crafted names containing HTML attribute-breaking characters.\nExploitation requires the attacker to successfully upload a file with a maliciously crafted filename and subsequently entice or wait for another user to view the directory listing containing the payload.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input sanitization and output encoding for filenames within the lib/helper/html.js file at line 28.\nThe vulnerable component directly concatenates raw filenames derived from uploaded files into HTML template structures without neutralizing HTML attribute-breaking characters.\nAffected versions include cube-root/directory-serve through version 1.3.7.\nThe attack flow begins when an attacker uploads a file featuring a specifically crafted filename containing characters designed to break out of HTML attributes, such as quotation marks and angle brackets.\nOnce the file is processed and stored by the application, the server generates a file listing interface utilizing lib/helper/html.js.\nWhen line 28 renders the directory contents, the unsanitized malicious filename is inserted directly into the HTML markup.\nSubsequent users who browse to the file listing trigger the payload because the browser interprets the injected attribute-breaking characters as HTML structure rather than plain text data.\nThe injected payload executes arbitrary JavaScript within the context of the victim browser session, inheriting the origin, cookies, and session tokens associated with the web application.\nPost-exploitation impact depends on the privileges of the viewing user, ranging from defacement and minor session disruption to complete compromise of administrative sessions if an admin views the malicious directory listing."
}