GCVE - cpe:2.3:a:cube-root:directory-serve:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cube-root:directory-serve:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cube Root (`e5234c58-cb14-50d7-a02a-08014a7215f6`)
Product	Directory Serve (`59dbfac8-9c01-5c0c-93f9-0277c9c8591c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-72570`	vulnerable	2026-09-16 04:33:08.898580	cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename MEDIUM (5.4) A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. Published: 2026-08-10T10:40:46.020Z Updated: 2026-08-10T17:51:17.121Z Open on db.gcve.eu Reference links https://github.com/cube-root/directory-serve https://github.com/cube-root/directory-serve/blob/main/lib/helper/html.js	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-72569`	vulnerable	2026-09-16 04:33:08.412568	cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion CRITICAL (9.1) A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. Published: 2026-08-10T10:40:43.169Z Updated: 2026-08-10T13:10:20.674Z Open on db.gcve.eu Reference links https://github.com/cube-root/directory-serve https://github.com/cube-root/directory-serve/blob/main/lib/middleware/file-remove.js	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.