CVE-2026-72570 is a stored XSS in cube-root/directory-serve through version 1.3.7, where user-supplied filenames are rendered into HTML directory listings without context-aware escaping. The attack vector—filenames containing HTML attribute-breaking characters—suggests the application embeds filenames into attribute values (like href or src) or unquoted tag parameters, allowing attackers to break out and inject script tags or event handlers.
The CVSS 5.4 score materially understates the real risk. The critical variable is whether uploads require authentication. If upload access is restricted to authenticated users, the attacker already has legitimate access and this becomes a session-hijacking tool against trusted users—ironically, those with the richest session context. If uploads are open to anonymous users—a plausible configuration for a directory-serve utility—every viewer of the listing becomes a victim without any credentials needed.
A naive htmlspecialchars() patch will fail. If filenames land inside JavaScript string literals or event handler attributes like onclick='showFile("FILENAME")', you need JavaScript-string encoding (backslash-escaping quotes and backslashes), not HTML entity encoding. Context-agnostic fixes create false confidence while leaving attribute-injection paths intact.
The 'through 1.3.7' qualifier is a red flag: it reads as 'still vulnerable as of' rather than 'fixed in,' indicating no confirmed patch exists. Combined with the maintainer's apparent 'don't upload untrusted files' posture—which shifts vulnerability onto users rather than addressing it—this suggests either no fix has been developed or a context-naive patch was attempted. Treat this as unpatched until proven otherwise.
If you deploy directory-serve, treat filenames as untrusted input surfaces and audit your template rendering code for attribute-context escaping. If the project has no public fix, consider a compensating control like restricting uploads to a sandboxed environment or wrapping the output in a Content-Security-Policy that blocks inline scripts.