8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22257

CVE-2026-22257: Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22257

CVE-2026-22257:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
salvo	rust	< 0.88.1	0.88.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the Salvo web framework's static file serving functionality. The root cause lies in the salvo_serve_static::dir::list_html function, which was responsible for generating an HTML directory listing. This function directly embedded filenames into the HTML output without performing any sanitization or encoding.

An attacker could exploit this by uploading a file with a specially crafted name containing HTML and JavaScript code. When a user navigates to the directory containing this file, the StaticDir::handle request handler (if auto_list is enabled) would call list_html. The resulting HTML page would include the malicious filename, causing the embedded JavaScript to execute in the user's browser.

The patch addresses this vulnerability at two points in the process:

Rendering (Primary Fix): It modifies list_html to use a new encode_url_path function, which properly encodes special HTML characters in filenames before they are rendered in the directory listing. This prevents the browser from interpreting parts of the filename as executable code.
Input (Defense-in-Depth): It enhances salvo_core::http::form::FilePart::create to sanitize filenames upon upload, stripping out potentially dangerous characters. This prevents malicious filenames from being saved to the filesystem in the first place.

Therefore, during exploitation, a profiler would show execution flowing through StaticDir::handle and into the vulnerable list_html function. The FilePart::create function would be observed during the initial upload of the malicious file.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.