UBUNTU-CVE-2026-73254

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-73254

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73254.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-73254

Upstream

CVE-2026-73254

Published

2026-08-20T18:16:00Z

Modified

2026-10-17T13:01:02Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.

References

Affected packages

Ubuntu:26.10 / mongoose

Package

Name: mongoose
Purl: pkg:deb/ubuntu/mongoose?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.21+ds-1

7.21+ds-2

7.22+ds-1

7.23+ds-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "mongoose-webserver-source",
            "binary_version":  "7.23+ds-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73254.json"