CVE-2026-72569

Name of the Vulnerable Software and Affected Versions cube-root/directory-serve versions prior to 1.3.8

Description A path traversal issue exists where an unauthenticated remote attacker can delete arbitrary files outside the intended served directory. This occurs when the application is executed with the --delete option. The lib/middleware/file-remove.js middleware fails to sanitize the file parameter in the request query before using it to construct file system paths, allowing the use of ../ sequences to traverse directories.

Recommendations Update cube-root/directory-serve to version 1.3.8 or later. As a temporary mitigation, avoid running the application with the --delete option.