CVE-2026-73254 cesanta CVE debrief

Who should care

Users of Mongoose versions prior to 7.22 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 7.22 or later, implementing compensating controls, and monitoring for suspicious activity. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and take necessary actions to protect their deployments.

Technical summary

Mongoose is an embedded web server and network library. Prior to version 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22 and later.

Defensive priority

Medium-priority defensive tasks are recommended due to the CVSS score of 5.4 and the potential for stored cross-site scripting.

Recommended defensive actions

• Inventory and version checks for Mongoose installations
• Upgrade to Mongoose version 7.22 or later
• Implement compensating controls such as web application firewalls
• Monitor for suspicious activity and exception tracking
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from the NVD and CVE.org indicates that Mongoose versions prior to 7.22 are vulnerable to stored cross-site scripting. The issue is fixed in version 7.22. Further review of the source code and affected deployments is recommended to assess exposure and validate vendor guidance.

Official resources