The stored XSS flaw in cube-root directory-serve up to version 1.3.7 allows an attacker to inject arbitrary JavaScript by uploading a file whose name contains characters that break out of an HTML attribute. When a user views the directory listing, the unsanitized filename is embedded directly in an HTML attribute, causing the browser to execute the embedded script. This victim-side code can be used for session hijacking, cookie theft, or other client-side attacks within the context of the user who views the page.

The vulnerability exists in cube-root directory-serve versions 1.3.7 and earlier. The application functions as a static file server that presents a web page listing uploaded files, exposing the directory structure to users.

With a CVSS score of 5.4, the flaw carries medium severity. The EPSS score is unavailable and it is not listed in the CISA KEV catalog. An attacker can exploit the issue by uploading a file with a crafted filename; no additional privileges are explicitly required for the upload endpoint. Once the malicious filename is present in the listing, any user who views the page may have their browser execute the injected script, potentially compromising session data and enabling further victim-directed attacks.