CVE-2026-72569
CriticalCVSS 9.1Summary
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.
Risk Assessment
An attacker can delete critical system files or application data, leading to data loss, service disruption, and potential system destabilization.
Recommendation
Update directory-serve to a patched version or apply a workaround such as validating paths and avoiding the --delete option in production environments without additional safeguards.
Original NVD description (English source)
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. The lib/middleware/file-remove.js middleware does not sanitize the req.query.file parameter before using it to construct file system paths, enabling directory traversal via ../ sequences.