5.4
Moyenne
CVE-2026-73254 Mongoose is an embedded web server and network library
Description
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Mongoose 7.22 | premières → < 7.22 | 7.22 |
Autres CVE de Mongoose
Les 38 CVE de Mongoose →
CVE-2026-115473
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
6.5
Moyenne
CVE-2026-63626
Mongoose is an embedded web server and network library
8.8
Élevée
CVE-2026-73261
Mongoose is an embedded web server and network library
7.5
Élevée
CVE-2026-73260
Mongoose is an embedded web server and network library
7.5
Élevée