Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing

Medium 5.4

In plain English

A medium-severity cross-site scripting in mongoose from cesanta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	mongoose	7.22+ds-1	DEBIAN-CVE-2026-73254
Ubuntu:26.10	mongoose	no fix listed	UBUNTU-CVE-2026-73254

Affected products (as reported)

Vendor	Product	Versions
cesanta	mongoose	< 7.22

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/cesanta/mongoose/security/advisories/GHSA-5g6j-m3pv-4f7g x_refsource_CONFIRM
https://github.com/cesanta/mongoose/pull/3611 x_refsource_MISC
https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 x_refsource_MISC
https://github.com/cesanta/mongoose/releases/tag/7.22 x_refsource_MISC