Description

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-20T18:16:46.113Z",
  "pubdate": "2026-08-20T18:16:46.113Z",
  "executiveSummary": "Mongoose prior to version 7.22 contains a stored cross-site scripting (XSS) vulnerability within its directory listing functionality. The flaw enables an attacker capable of creating a file with an HTML payload in its filename to trigger arbitrary JavaScript execution when a victim browses an affected directory served with MG_ENABLE_DIRLIST enabled. The vulnerability impacts the Mongoose embedded web server and network library, posing significant risk implications by exposing session data and permitting unauthorized actions within the Mongoose origin on behalf of the victim. Exploitation requires the attacker to successfully introduce a crafted filename into the target filesystem and necessitates user interaction where a victim browses the vulnerable directory listing. The issue is fully resolved in Mongoose version 7.22 through appropriate output encoding corrections in the directory listing generation routines.",
  "technicalDetails": "The vulnerability is rooted in improper output handling within the directory listing generation logic of Mongoose. Specifically, the function printdirentry() called by listdir() located in src/http.c correctly URL-encodes the hypertext reference href attribute but fails to properly sanitize or encode the raw filesystem filename when inserting it directly into the HTML link text. Consequently, when a user accesses a directory served with MG_ENABLE_DIRLIST enabled, the unescaped malicious payload embedded within the filename is rendered directly by the web browser as active HTML and JavaScript markup.\nThe attack flow proceeds as follows: First, an attacker with local or remote write access to the targeted filesystem creates a file whose name contains a malicious HTML and JavaScript payload. Second, a victim user navigates to the directory listing page served by the Mongoose web server where MG_ENABLE_DIRLIST is active. Third, the server executes listdir() and printdirentry(), generating the HTML response containing the raw, unescaped filename in the body of the link text. Fourth, the victim's browser parses the HTTP response, identifies the injected markup, and executes the payload within the security context and origin of the Mongoose web server.\nThe vulnerable component is the printdirentry() function inside src/http.c. Affected versions include all Mongoose releases prior to version 7.22. The vulnerability manifests without requiring authentication or specific high-level privileges, provided the attacker can introduce the crafted file into the served directory path and network exposure allows victims to browse the directory listing. The resulting payload behavior includes executing arbitrary script code in the victim browser session, potentially leading to the exposure of sensitive session data, token theft, or the execution of unauthorized actions with the privileges of the victim user."
}