This vulnerability is a stored XSS in cube-root directory-serve versions prior to 1.3.8. It arises from improper neutralization of input during web page generation, specifically when handling filenames of uploaded files. An attacker can craft a filename containing HTML attribute-breaking characters to inject arbitrary JavaScript code into the web interface, potentially leading to cross-site scripting attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited confidentiality and integrity impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected web interface, potentially leading to partial disclosure or modification of sensitive information accessible to the user. There is no impact on system availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about uploading files with untrusted filenames and consider implementing input validation or sanitization on filenames as a temporary mitigation.