Threats affecting pkg:github/cube-root/directory-serve

A path traversal vulnerability exists in cube-root/directory-serve versions through 1.3.7 that allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option. This vulnerability can lead to high impact on integrity and availability without requiring authentication or user interaction.

CVE-2026-72570 is a stored cross-site scripting (XSS) vulnerability in the cube-root directory-serve product up to version 1.3.7. It allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. This vulnerability can lead to partial compromise of confidentiality and integrity but does not affect availability. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently available from the vendor.