Security Advisory
CVE-2026-72570
5.4
MEDIUM
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters.
Published Date
August 10, 2026
Official Source
NIST NVD Advisory