CVE-2026-22257
Published: 08 January 2026
Summary
CVE-2026-22257 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Salvo Salvo. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-22257 is a cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the Salvo Rust web backend framework prior to version 0.88.1. The issue resides in the list_html function within the serve-static crate, which generates an HTML view of a folder's contents without sanitizing file or folder names. This flaw can lead to XSS when a website exposes public file access via this feature and permits file uploads.
Attackers without privileges can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no required user interaction beyond viewing the directory listing (UI:R), resulting in a changed scope (S:C). By uploading files with malicious names to an accessible directory, an unauthenticated attacker triggers XSS upon rendering of the list_html output, achieving high confidentiality impact (C:H), low integrity impact (I:L), and low availability impact (A:L), as reflected in the CVSS v3.1 base score of 8.8.
The vulnerability has been addressed in Salvo version 0.88.1. Security advisories recommend upgrading to this patched version. Additional details are available in the GitHub Security Advisory at https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j and the affected code at https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1423
Vulnerability details
Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing the files or folders names, this may potentially lead to XSS in cases where a website allow…
more
the access to public files using this feature and anyone can upload a file. This issue has been patched in version 0.88.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XSS in public-facing serve-static directory listing directly enables remote exploitation of web app (T1190) and facilitates browser session hijacking or cookie theft via injected scripts (T1185, T1539).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires filtering of information output to web browsers, directly preventing XSS execution from unsanitized file and folder names in directory listings generated by list_html.
Mandates timely identification, reporting, and correction of system flaws, such as patching Salvo to version 0.88.1 to fix the sanitization vulnerability.
Enforces validation of inputs like uploaded file names to block malicious payloads that could trigger XSS when rendered in directory listings.