https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 02:12:45 +0000 https://vulnerability.circl.lu/vuln/ghsa-45p5-v273-3qqr <p><strong>Affected:</strong> Maven: io.vertx:vertx-web</p> <p># Description</p> <p>- In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping. - As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS. - Affected Code: - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java` - Lines: - 709–713: `normalizedDir` is constructed without escaping - 714–731: `&lt;li&gt;&lt;a ...&gt;` elements insert file names directly into attributes and body without escaping - 744: parent directory name construction - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping</p> <p># Reproduction Steps</p> <p>1. Prerequisites: - Directory listing is enabled using `StaticHandler` (e.g., `StaticHandler.create(&#34;public&#34;).setDirectoryListing(true)`) - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)</p> <p>2. Create a malicious file name (example for Unix-based OS): - Create an empty file in `public/` with one of the following names: - `&lt;img src=x onerror=alert(&#39;XSS&#39;)&gt;.txt` - Or attribute injection: `evil&#34; onmouseover=&#34;alert(&#39;XSS&#39;)&#34;.txt` - Example: ```bash mkdir -p public printf…</p> <p><strong>Affected:</strong> Maven: io.vertx:vertx-web</p> <p># Description</p> <p>- In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping. - As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS. - Affected Code: - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java` - Lines: - 709–713: `normalizedDir` is constructed without escaping - 714–731: `&lt;li&gt;&lt;a ...&gt;` elements insert file names directly into attributes and body without escaping - 744: parent directory name construction - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping</p> <p># Reproduction Steps</p> <p>1. Prerequisites: - Directory listing is enabled using `StaticHandler` (e.g., `StaticHandler.create(&#34;public&#34;).setDirectoryListing(true)`) - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)</p> <p>2. Create a malicious file name (example for Unix-based OS): - Create an empty file in `public/` with one of the following names: - `&lt;img src=x onerror=alert(&#39;XSS&#39;)&gt;.txt` - Or attribute injection: `evil&#34; onmouseover=&#34;alert(&#39;XSS&#39;)&#34;.txt` - Example: ```bash mkdir -p public printf…</p> https://vulnerability.circl.lu/vuln/ghsa-45p5-v273-3qqr