medium5.4
CVE-2026-72570
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web int…
Impact
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.
Affected products
| Product | Affected versions |
|---|---|
| Cube-Root/Directory-Serve | through 1.3.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.