CVE-2026-73254

Mongoose: Stored XSS via unescaped filenames in directory listing

Published Aug 20, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

Analysis

Technical impact

Mongoose, an embedded web server, stored a cross‑site scripting flaw in directory listings. File names that contained arbitrary HTML were inserted unescaped into the body of the directory page. A browser visiting that page would interpret the injected markup within the Mongoose origin, allowing the attacker to steal session cookies or perform privileged actions as the user. The weakness is a classic reflected input problem (CWE‑79).

Affected Systems

Cesanta’s Mongoose web server in versions before 7.22. Any deployments that enable directory listing (MG_ENABLE_DIRLIST) are vulnerable, regardless of other access controls. Upgrade to 7.22 or later to eliminate the bug.

Risk and Exploitability

The CVSS score is 5.4, indicating medium severity. An attacker must be able to create a file on the filesystem served by Mongoose and reach a user who views the directory list; this is feasible in shared hosting or misconfigured sites. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, meaning there is no immediate evidence of widespread exploitation. Given these constraints, the risk remains moderate while the potential impact can be significant due to XSS.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cesanta

mongoose

affected

Version	Status	Constraints
`< 7.22`	affected	—

Configuration 1 [-]

cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Cesanta

Mongoose

Version	Status	Scheme	Platform
`[0,7.22)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mongoose to version 7.22 or later, which removes the unescaped filename insertion.
Configure the server to disable directory listings (disable MG_ENABLE_DIRLIST) if the feature is not required.
If an upgrade is not yet possible, sanitize filenames to strip or escape HTML before displaying them in listings, or use a whitelist to allow only safe characters.

Generated by OpenCVE AI on August 20, 2026 at 20:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.344% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71
https://github.com/cesanta/mongoose/pull/3611
https://github.com/cesanta/mongoose/releases/tag/7.22
https://github.com/cesanta/mongoose/security/advisories/GHSA-5g6j-m3pv-4f7g

History

Sep 29, 2026 3:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:cesanta:mongoose::::::::

Aug 22, 2026 4:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 20, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cesanta Cesanta mongoose
Vendors & Products		Cesanta Cesanta mongoose

Aug 20, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
Title		Mongoose: Stored XSS via unescaped filenames in directory listing
Weaknesses		CWE-79
References		https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 https://github.com/cesanta/mongoose/pull/3611 https://github.com/cesanta/mongoose/releases/tag/7.22 https://github.com/cesanta/mongoose/security/advisories/GHSA-5g6j-m3pv-4f7g
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}`