CVE-2026-73254: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cesanta mongoose

The vulnerability arises from improper neutralization of input during web page generation in the printdirentry() function called by listdir() in src/http.c of mongoose. While the href attribute is URL-encoded, the raw filesystem filename is inserted directly into the HTML link text, enabling stored XSS when directory listing is enabled. This allows an attacker who can create files with crafted names to inject malicious HTML/JavaScript that executes in the context of the mongoose server origin. The vulnerability is addressed in mongoose version 7.22.

Successful exploitation can lead to execution of arbitrary scripts in the context of the mongoose server origin. This may expose session information or allow the attacker to perform actions on behalf of the victim user. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact.

Upgrade to mongoose version 7.22 or later where this vulnerability is fixed. No other mitigations are indicated or required once the official fix is applied.