CVE-2026-73259

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description A reflected cross-site scripting issue exists when the MG ENABLE DIRLIST feature is enabled. A remote attacker can send a crafted percent-encoded request path to a user, which is then processed by the mg http serve dir() and listdir() functions in src/http.c. These functions place the decoded request URI into the title and h1 HTML elements without proper HTML entity encoding. This allows the execution of malicious scripts in the Mongoose origin, potentially exposing session data or allowing actions to be performed on behalf of the victim.

Recommendations Update to version 7.22. As a temporary mitigation, disable the MG ENABLE DIRLIST feature.