Read the docs
TI-2024-21833 Aliases CVE-2024-32966GHSA-rwfq-v4hq-h7fg

Stored Cross-site Scripting in directory listings via file names in static-web-server

Priority MEDIUM 59CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like `<img src=x onerror=alert(1)>.txt` will allow JavaScript code execution in the context of the web server’s domain. SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least `file_name` and `current_path` could contain malicious data however. `file_uri` could also be malicious but the relevant scenarios seem to be all caught by hyper. For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored Cross-site Scripting vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00369 31st percentileScored 2026-11-07
Fix Fixed static-web-server (static-web-server): 2.30.0static-web-server (crates.io): 2.30.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
static-web-serverstatic-web-serverbefore 2.30.02.30.0Patch availableCNA
—static-web-server (crates.io)before 2.30.02.30.0Patch availableGHSA-rwfq-v4hq-h7fg
  • static-web-server Vendorstatic-web-server Affected before 2.30.0 Fixed in 2.30.0 Patch available CNA
  • static-web-server (crates.io) Vendor— Affected before 2.30.0 Fixed in 2.30.0 Patch available GHSA-rwfq-v4hq-h7fg

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:static-web-server:static-web-server:*:*:*:*:*:*:*:*——static-web-server
  • cpe:2.3:a:static-web-server:static-web-server:*:*:*:*:*:*:*:* Versions — — ·static-web-server

Remediation

  • Fix · CNA static-web-server (static-web-server) Fixed in 2.30.0
  • Fix · GHSA-rwfq-v4hq-h7fg static-web-server (crates.io) Fixed in 2.30.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32966
  2. 2026-10-03 Alias added: GHSA-rwfq-v4hq-h7fg

References

Advisory 1

Other 3

  • TI-2025-41246 Static Web Server is vulnerable to symbolic link Path Traversal CVSS 4.0MEDIUM 5.5
  • TI-2026-21887 Static Web Server: Timing-Based Username Enumeration in Basic Authentication CVSS 3.1MEDIUM 5.3
  • TI-2026-52908 Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences