CVE-2026-72569: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in cube-root directory-serve
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.
AI Analysis
Technical Summary
This vulnerability in cube-root directory-serve (through version 1.3.7) involves improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the lib/middleware/file-remove.js middleware fails to sanitize the req.query.file parameter before using it to construct filesystem paths. When the application is run with the --delete option, an unauthenticated remote attacker can exploit this flaw by supplying crafted '../' sequences to delete arbitrary files outside the served directory.
Potential Impact
An unauthenticated attacker can delete arbitrary files on the filesystem outside the intended directory served by the application, potentially causing denial of service or data loss. The vulnerability does not impact confidentiality but has high integrity and availability impact as per the CVSS 3.1 score of 9.1.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the application with the --delete option or restrict access to trusted users only to mitigate the risk of exploitation.
CVE-2026-72569: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in cube-root directory-serve
Description
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.
CVSS v3.1
Score 9.1critical
Affected software
pkg:npm/cube-root/directory-serveRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in cube-root directory-serve (through version 1.3.7) involves improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the lib/middleware/file-remove.js middleware fails to sanitize the req.query.file parameter before using it to construct filesystem paths. When the application is run with the --delete option, an unauthenticated remote attacker can exploit this flaw by supplying crafted '../' sequences to delete arbitrary files outside the served directory.
Potential Impact
An unauthenticated attacker can delete arbitrary files on the filesystem outside the intended directory served by the application, potentially causing denial of service or data loss. The vulnerability does not impact confidentiality but has high integrity and availability impact as per the CVSS 3.1 score of 9.1.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the application with the --delete option or restrict access to trusted users only to mitigate the risk of exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TuranSec
- Date Reserved
- 2026-08-10T10:32:53.853Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a79ae6ebf8831d5398afd09
Added to database: 08/10/2026, 10:56:46 UTC
Last enriched: 08/10/2026, 11:14:18 UTC
Last updated: 08/11/2026, 03:40:59 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.