Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-72570 EUVD-2026-55236GHSA-g77q-hxjf-7mcc

cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

Published Aug 10, 2026 · Updated Aug 10, 2026 · Assigned by TuranSec

Vendor: cube-root Product: directory-serve

Description

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.

Affected products

VendorProductAffectedFixed
cube-root directory-serve ≤ 1.3.7 —

References