CVE-2026-72570

MediumCVSS 5.4

Published: 10/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

A stored XSS vulnerability in directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename.

Risk Assessment

Arbitrary script execution in the victim's browser, potentially leading to session theft or account takeover.

Recommendation

Update directory-serve to the latest version or sanitize filenames before rendering.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.