A percent‑encoded request path directed to a directory listing endpoint in Mongoose 7.21 and earlier places the decoded URI directly into the HTML title and h1 tags without escaping, allowing a reflected cross‑site scripting attack. When a vulnerable user visits the crafted URL, the browser executes the embedded script in the context of the Mongoose origin, which can compromise session data or perform actions on behalf of that user.

Cesanta’s Mongoose web server, versions earlier than 7.22. Any deployment using the MG_ENABLE_DIRLIST option is susceptible, including all 7.x releases prior to the 7.22 fix.

The CVSS score of 5.4 indicates moderate severity and an attack vector that requires network access to the HTTP endpoint. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. An attacker must craft a percent‑encoded path and persuade a victim to visit the URL; no privilege escalation is required, but the impact is limited to the victim’s session. The vulnerability would be exploitable as long as directory listings remain enabled on a reachable instance of any affected Mongoose version.