Description
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
Published: 2026-08-20
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Mongoose, an embedded web server, stored a cross‑site scripting flaw in directory listings. File names that contained arbitrary HTML were inserted unescaped into the body of the directory page. A browser visiting that page would interpret the injected markup within the Mongoose origin, allowing the attacker to steal session cookies or perform privileged actions as the user. The weakness is a classic reflected input problem (CWE‑79).

Affected Systems

Cesanta’s Mongoose web server in versions before 7.22. Any deployments that enable directory listing (MG_ENABLE_DIRLIST) are vulnerable, regardless of other access controls. Upgrade to 7.22 or later to eliminate the bug.

Risk and Exploitability

The CVSS score is 5.4, indicating medium severity. An attacker must be able to create a file on the filesystem served by Mongoose and reach a user who views the directory list; this is feasible in shared hosting or misconfigured sites. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, meaning there is no immediate evidence of widespread exploitation. Given these constraints, the risk remains moderate while the potential impact can be significant due to XSS.

Generated by OpenCVE AI on August 20, 2026 at 20:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mongoose to version 7.22 or later, which removes the unescaped filename insertion.
  • Configure the server to disable directory listings (disable MG_ENABLE_DIRLIST) if the feature is not required.
  • If an upgrade is not yet possible, sanitize filenames to strip or escape HTML before displaying them in listings, or use a whitelist to allow only safe characters.

Generated by OpenCVE AI on August 20, 2026 at 20:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Cesanta
Cesanta mongoose
Vendors & Products Cesanta
Cesanta mongoose

Thu, 20 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
Title Mongoose: Stored XSS via unescaped filenames in directory listing
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Cesanta Mongoose
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-21T16:22:13.424Z

Reserved: 2026-08-11T17:18:01.598Z

Link: CVE-2026-73254

cve-icon Vulnrichment

Updated: 2026-08-21T16:22:09.471Z

cve-icon NVD

Status : Received

Published: 2026-08-20T18:16:46.113

Modified: 2026-08-21T17:16:44.093

Link: CVE-2026-73254

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:15:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')