CVE-2026-73254 is a stored cross-site scripting vulnerability in cesanta mongoose versions before 7.22. The issue arises in the printdirentry() function called by listdir() in src/http.c, which URL-encodes the href attribute but inserts the raw filesystem filename into the HTML link text. An attacker who can create a file with an HTML payload in its name can trigger execution of this payload in the context of the Mongoose origin when a user browses a directory served with MG_ENABLE_DIRLIST enabled. This can lead to exposure of session data or unauthorized actions performed as the victim user. The vulnerability is addressed in version 7.22.

Successful exploitation allows an attacker to execute arbitrary HTML/JavaScript in the context of the Mongoose web server origin, potentially exposing session data or enabling actions on behalf of the victim user. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impact with no availability impact.

This vulnerability is fixed in Mongoose version 7.22. Users should upgrade to version 7.22 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, disabling the MG_ENABLE_DIRLIST option can mitigate exposure to this vulnerability by preventing directory listings that include vulnerable filename rendering.