Stored Cross-Site Scripting Vulnerability in Mongoose Web Server
CVE-2026-73254

5.4MEDIUM

Key Information:

Vendor

Cesanta

Status
Mongoose
Vendor
CVE Published:
20 August 2026

What is CVE-2026-73254?

Mongoose, an embedded web server, is vulnerable to a stored cross-site scripting flaw. An attacker could exploit this vulnerability by crafting a file with an HTML payload name, which triggers XSS when users access a directory enabled with MG_ENABLE_DIRLIST. The vulnerability arises from the printdirentry() function invoked by listdir(), which URL-encodes the href but includes the raw filesystem filename in the HTML link text. This flaw could allow malicious script execution in the context of the Mongoose server, leading to potential exposure of user session data and unauthorized actions.

Affected Version(s)

mongoose < 7.22

References

https://github.com/cesanta/mongoose/security/advisories/G...
x_refsource_CONFIRM
https://github.com/cesanta/mongoose/pull/3611
x_refsource_MISC
https://github.com/cesanta/mongoose/commit/a9df523f76f43a...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.