This vulnerability in cube-root/directory-serve (through version 1.3.7) is due to improper neutralization of input during web page generation (CWE-79). Specifically, the lib/helper/html.js file fails to sanitize filenames before embedding them in HTML templates at line 28. An attacker can exploit this by uploading a file with a crafted filename containing HTML attribute-breaking characters, resulting in stored cross-site scripting. When other users view the file listing, the injected script executes in their browsers.

Successful exploitation allows an attacker with upload privileges to execute arbitrary JavaScript in the context of other users' browsers who view the affected file listing. This can lead to information disclosure or session hijacking limited to the privileges of the affected users. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact without availability impact.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should restrict file upload permissions to trusted users only and consider manual sanitization or filtering of filenames before upload or display to mitigate the risk.