CVE-2026-73259 - Mongoose: Reflected XSS via decoded URI in directory listing render
Brief
CVE ID : CVE-2026-73259
Published : Aug. 20, 2026, 6:16 p. m.
- 52 minutes ago
Description : Mongoose is an embedded web server and network library. Prior to 7. 22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http. c places the decoded request URI into the title and h1 elements without HTML entity encoding.
The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.
- Severity: 5.4
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...