The vulnerability identified as CVE-2026-72570 is a stored XSS issue affecting cube-root/directory-serve versions up to 1.3.7. An attacker can exploit this by uploading a file whose filename includes crafted characters that break HTML attributes, resulting in arbitrary JavaScript execution within the web interface. This can lead to partial confidentiality and integrity impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). There is no evidence of known exploits in the wild, and no patch or official fix has been documented in the provided data.

Successful exploitation allows an attacker with some privileges (low user interaction required) to execute arbitrary JavaScript in the context of the vulnerable web interface, potentially leading to partial compromise of confidentiality and integrity of user data or session information. Availability is not impacted. The attack complexity is low, but requires some privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting file upload capabilities or sanitizing filenames to prevent injection of HTML attribute-breaking characters. Monitor vendor channels for updates or official patches.