CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:LCVE-2026-22257
High (8.8) in salvo salvo. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in salvo 0.88.1.
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- salvo:salvo
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-54m3-5fxr-2f3j | crates.io | salvo | <0.88.1 | 0.88.1 |