Listen to this Post
The vulnerability exists within the `list_html` function of the static file directory handler. When generating an HTML page to list directory contents, the function unsafely inserts the `current.path` variable directly into the HTML `<>` tag without proper sanitization or output encoding. While the request path is initially decoded and normalized for route matching, this sanitized version is not used when rendering the page. The raw, user-controlled path string is instead formatted into the HTML output. An attacker can craft a URL containing a malicious JavaScript payload within the path parameter. When a victim visits this crafted URL, the server reflects the payload into the generated page’s . The browser then interprets the payload as executable code, not as inert text. The only constraint is that the requested path must correspond to an existing subdirectory within the static file root (e.g., /files/scripts/). This requirement ensures the server returns the auto-generated directory listing HTML page instead of a “Not Found” error, making the exploit conditional but feasible in common deployments.
Platform: Salvo
Version: 0.85.0
Vulnerability: Reflected XSS
Severity: Critical
date: 2026-01-09
Prediction: 2024-08-15
What Undercode Say:
Bash Commands
mkdir uploads
mkdir uploads/bla
How Exploit:
GET /files/scripts/”> HTTP/1.1
Host: target.com
Protection from this CVE
Update Salvo
Sanitize `current.path`
Use templating engine
Implement strict CSP
Impact:
JavaScript execution
Session hijacking
Account takeover
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
