What’s Vulnerable › Vulnerabilities

CVE-2026-22257: Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-08 · updated 2026-06-17
• Weakness: CWE-79

Description

Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.

Affected products

• salvo-rs salvo: before 0.88.1 — fixed in 0.88.1

How to fix

Upgrade to a fixed version: salvo-rs salvo 0.88.1. Check the vendor advisory for mitigations.

References

• https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581
• https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j

Get alerted when CVE-2026-22257 or the next vulnerability affects your stack