Threats affecting pkg:npm/cube-root/directory-serve

CVE-2026-72569 is a critical path traversal vulnerability in cube-root's directory-serve application up to version 1.3.7. It allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.