CVE-2026-22256

HIGH EPSS 21.6%
Published Jan 8, 20265mo ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Jan 8, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a render of the current path, in which its inserted in the HTML without proper sanitation, this leads to reflected XSS using the fact that request path is decoded and normalized in the matching stage but not is inserted raw in the html view (current.path), the only constraint here is for the root path (eg. /files in the PoC example) to have a sub directory (e.g common ones styles/scripts/etc…) so that the matching return the list HTML page instead of the Not Found page. This issue has been patched in version 0.88.1.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality High
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
21.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
salvosalvo* <0.88.1

References 2

  • github.com https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L593
    Patch
  • github.com https://github.com/salvo-rs/salvo/security/advisories/GHSA-rjf8-2wcw-f6mp
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L593
    Patch