CVE-2026-73254

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description An issue exists where an attacker can trigger stored cross-site scripting (XSS) by creating a file with an HTML payload in its name. This occurs when a user browses a directory served with MG ENABLE DIRLIST. The printdirentry() function, called by listdir() in src/http.c, URL-encodes the href but inserts the raw filesystem filename into the HTML link text. Consequently, the browser executes the injected markup in the Mongoose origin, potentially exposing session data or allowing actions to be performed as the victim.

Recommendations Update to version 7.22. As a temporary mitigation, disable the MG ENABLE DIRLIST feature to prevent directory browsing.