Description

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-20T18:16:47.730Z",
  "pubdate": "2026-08-20T18:16:47.730Z",
  "executiveSummary": "A reflected cross-site scripting vulnerability exists in the Mongoose embedded web server and network library prior to version 7.22.\nThe vulnerability occurs when directory listing functionality is enabled via MG_ENABLE_DIRLIST, allowing an unauthenticated remote attacker to construct and deliver a malicious percent-encoded request path.\nWhen a victim visits the crafted URL, the application processes the request within src/http.c, specifically through the mg_http_serve_dir() and listdir() functions.\nThe decoded request URI is unsanitized and rendered directly into the HTML title and h1 elements without proper HTML entity encoding.\nConsequently, arbitrary JavaScript executes within the Mongoose origin, leading to potential session data exposure and unauthorized actions performed on behalf of the victim.\nExploitation requires user interaction, specifically persuading a victim to visit the crafted request path against a deployment utilizing the directory listing feature.",
  "technicalDetails": "The vulnerability stems from improper output neutralization during HTTP directory listing generation within the Mongoose embedded web server and network library.\nThe vulnerable components reside in src/http.c, specifically inside the mg_http_serve_dir() and listdir() functions.\nPrior to version 7.22, when a deployment has MG_ENABLE_DIRLIST enabled, these functions handle incoming HTTP requests containing percent-encoded paths.\nThe root cause of the vulnerability is the direct inclusion of the decoded request URI into the generated HTML document's title and h1 elements without applying necessary HTML entity encoding.\nAn unauthenticated remote attacker exploits this behavior by crafting a malicious URI containing HTML and JavaScript payloads, utilizing percent-encoding to bypass superficial inspection or transport-layer interference.\nThe attack flow proceeds as follows: first, the attacker constructs the malicious percent-encoded request path targeting a vulnerable Mongoose deployment; second, the attacker persuades a victim to click or visit the crafted URL; third, the Mongoose server parses the request, decodes the URI in src/http.c, and dynamically constructs the directory listing HTML page incorporating the raw, unescaped URI string into the title and h1 tags; fourth, the victim's browser parses the HTTP response and executes the embedded script in the context of the Mongoose origin.\nBecause the script executes within the application's origin, the payload possesses the capability to access sensitive session data, manipulate Document Object Model elements, or perform unauthorized actions as the authenticated victim.\nThe vulnerability affects Mongoose versions prior to 7.22, requires network exposure of the web server, and depends on user interaction alongside the configuration of the MG_ENABLE_DIRLIST feature."
}