p PatchFirst

CVE-2026-73259

CVE-2026-73259 · Mongoose: Reflected XSS via decoded URI in directory listing render

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.

CVSS 5.4 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongoose

    Versions
    • < 7.22: Affected

    No fix published

  • mongoose Debian:14

    Versions
    • 7.21+ds-1
    • 7.21+ds-1~bpo13+1
    • 7.21+ds-2
    • 7.22+ds-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.22+ds-1

    Update to 7.22+ds-1

  • mongoose Ubuntu:26.10

    Versions
    • 7.21+ds-1
    • 7.21+ds-2
    • 7.22+ds-1
    • 7.23+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →