CVE-2026-73254

The CVSS score of 5.4 for this vulnerability badly understates the real risk, and here's why that matters for your defensive posture. Mongoose 7.22 fixes a classic encoding mismatch in directory listing: the href attribute gets URL-encoded but the link text does not. An attacker who can place a specially-named file in a served directory — and that prerequisite is far easier to meet than the CVSS model assumes — gets stored XSS executing in Mongoose's origin. That origin typically serves internal dashboards, admin interfaces, or diagnostic endpoints. The injected script inherits every cookie, token, or credential scoped to that origin. This is not a contained XSS in an iframe — it's a session harvest with maximum reach. The 'attacker must create a file' prerequisite in the CVSS scoring assumes this is a high bar. It isn't. Applications with user-facing upload functionality, CI/CD pipelines writing artifacts, misconfigured permissions, and container volume mounts all create the condition where untrusted parties can place files in directories Mongoose serves. File creation by untrusted actors is an architectural feature of many deployments, not an attacker compromise. The scoring model assumes a 2010 threat landscape. The deeper problem is the discovery gap. Mongoose ships embedded inside other software — often statically linked — where developers don't realize directory listing is enabled. The MG_ENABLE_DIRLIST flag gets set by whoever embedded Mongoose, not by the final operator debugging a directory traversal XSS. That's a coordination failure across deployment boundaries. The EPSS score of 0.00194 reflects what has been observed in the wild, not what exists in deployed systems. It measures non-discovery, not rarity. Your action checklist: verify which version of Mongoose you're running (any 7.x below 7.22 is vulnerable), audit any served directories for files with unusual names, and treat directory listing as a security-relevant configuration even if it was enabled as a debug feature. Check whether your deployment uses static linking — if so, the library version may not auto-update and you may need a rebuilt binary from your vendor. Finally, pressure-test whether 7.22 hardens filename handling globally or only patches the specific printdirentry() path. If it's the latter, adjacent code paths using the same filename-handling assumptions likely remain vulnerable.

Reviewed through automated stages and approved by a human before publication.