Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: cube-root Clear all filters
TI-2026-50828 CVE-2026-72570 · GHSA-g77q-hxjf-7mcc

cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

Priority LOW 24

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00235 Published 2026-08-10 No fix listed CWE-79
TI-2026-50827 CVE-2026-72569 · GHSA-gqqc-7rm5-p6gm

cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion

Priority MEDIUM 47

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --d…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00736 Published 2026-08-10 No fix listed CWE-22