CVE-2026-73259

Executive Summary

CVE-2026-73259 is a reflected cross-site scripting (XSS) vulnerability in Mongoose, the embedded web server and network library maintained by Cesanta. Deployments built with the MG_ENABLE_DIRLIST compile-time option are affected when a remote attacker can craft a percent-encoded request path that the server decodes and reflects into HTML output without entity encoding. Successful exploitation executes attacker-controlled script in the Mongoose origin and can expose session data or perform actions on behalf of a victim who is persuaded to visit a crafted link. The issue is fixed in Mongoose 7.22; all prior versions are considered vulnerable.

Technical Analysis

Mongoose is an embedded web server and network library used in IoT devices, industrial controllers, and other resource-constrained environments where a full web server stack is impractical. A commonly enabled feature of such deployments is directory listing: when the MG_ENABLE_DIRLIST build flag is defined, Mongoose will render a browsable index of a served directory rather than returning a 404. This is convenient for device administration interfaces and for firmware developers shipping file-browsing functionality.

The vulnerability resides in the request-handling path implemented by mg_http_serve_dir() and listdir() in src/http.c. When a client requests a path, Mongoose decodes the request URI — including percent-encoded sequences such as %XX — before using the resulting value as content in the generated HTML. Specifically, the decoded URI string is placed into the page’s <title> element and its <h1> heading without applying HTML entity encoding to the characters contained in it. Because the URI is reflected from the request directly into the response body, an attacker who controls the request path controls markup inserted into the returned page.

The root cause is the classic output-encoding failure that defines CWE-79: data from an untrusted source (the network-facing HTTP request line) is concatenated into an HTML context without contextual escaping. Percent-encoding is the delivery mechanism here. Because the server performs percent-decoding on the path prior to reflection, payload characters that would otherwise be inconvenient or blocked in a raw request line — angle brackets, quotes, parentheses, slashes — can be transmitted in %3C, %3E, %22, %28, %29, %2F form and reconstituted server-side. The absence of entity encoding means <, >, ", ', and & in the decoded value are rendered verbatim by the visiting browser. The response therefore constitutes reflected XSS rather than stored XSS, and delivery requires the victim to navigate to the attacker-supplied URL.

The attack surface is any Mongoose build compiled with MG_ENABLE_DIRLIST that exposes an HTTP endpoint over a network reachable by the attacker’s link. The CVSS vector — AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (score 5.4) — accurately reflects the profile: network reachable, no privileges required, low attack complexity, but user interaction required because the victim must click the crafted link. Scope is unchanged (the script runs in the Mongoose origin, which is the affected component’s own origin). Confidentiality and integrity impacts are rated Low, matching the practical ceiling of reflected XSS on a typical embedded device admin page. Availability is unaffected.

No public PoC code or Nuclei template was identified in the source data for this CVE, though the PoC status field is marked Public, indicating that exploit knowledge is available (typically as a published advisory or proof-of-concept description rather than a packaged weapon). Insufficient technical detail is available to describe the precise byte-level payload published by the finder.

Exploitation Scenarios

The attack chain for CVE-2026-73259 proceeds as follows, described at the vulnerability-class level in line with the details present in the source advisory.

1. Reconnaissance / target identification. The attacker identifies a device or service running Mongoose at a version prior to 7.22 that has been built with directory listing enabled. This is typically inferred from banner or response fingerprinting (e.g., a directory index page, server headers, or an exposed MG_ENABLE_DIRLIST-generated listing endpoint) or from known product usage of Mongoose in the targeted device class. No authentication is required for reconnaissance or for the eventual request.

2. Crafting the malicious request. The attacker constructs a request path containing percent-encoded HTML metacharacters. Because the server percent-decodes the path before reflecting it into the <title> and <h1> elements, the encoded characters are reconstituted as live markup in the generated directory-listing page. The attacker’s goal is to close the existing HTML element context and inject a script payload that the visiting browser will execute in the Mongoose origin.

3. Delivery / user interaction. Reflected XSS requires social engineering. The attacker sends the crafted URL to a victim — a device administrator, operator, or any user with a session on the Mongoose admin interface — through phishing email, chat, or a planted link. When the victim clicks the link, the browser sends the request to the Mongoose server; the server reflects the decoded payload in its response; the victim’s browser parses the response and executes the script in the context of the Mongoose origin.

4. Post-exploitation impact. Script executing in the Mongoose origin runs with the victim’s privileges against that origin. Consistent with the advisory, this can expose session data (cookies or tokens accessible to the origin) and can perform actions as the victim — for example, issuing authenticated requests to the device’s administrative interface, changing configuration, or exfiltrating data returned by those requests. The CVSS subscores (C:L, I:L, A:N) bound the expected impact to limited confidentiality and integrity effects; the attacker cannot directly crash the service (A:N), and scope remains confined to the Mongoose application origin.

No public PoC available; attack chain is inferred from the reflected XSS vulnerability class and the mechanism described in the NVD entry.

Impact Assessment

CVE-2026-73259 affects any Cesanta Mongoose deployment prior to 7.22 that is compiled with the MG_ENABLE_DIRLIST option. Mongoose is widely embedded in IoT, industrial, networking, and consumer devices, so the blast radius is defined by product-level adoption of the library combined with the directory-listing build configuration — not by Internet-wide exposure of a single vendor product. Deployments that do not enable directory listing are not affected by this specific code path.

Business impact tracks the underlying asset class. On an administrative interface for a network device, a programmable logic controller, or an IoT gateway, a successful reflected XSS gives an attacker script execution in the device-management origin on behalf of a logged-in operator. That is sufficient to read session material accessible to the page, pivot administrative actions through the victim’s authenticated session, and potentially alter device configuration. Where the admin session carries broad authority over the device, the practical consequences — even under a “Low” integrity subscore — can include unauthorized reconfiguration, changed network behavior, or data exfiltration through the victim’s browser.

The CVSS base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) places this in the Medium severity band. The critical constraints are (a) user interaction is required (UI:R), which sharply reduces opportunistic exploitation, and (b) impacts are limited to Low confidentiality and Low integrity with no availability effect. There is no CISA KEV listing, indicating no confirmed exploitation in the wild at the time of reporting, and EPSS is 0.00407 (32.4th percentile), a low predicted likelihood of exploitation over the next 30 days. The combination of Medium severity, low EPSS, and no KEV entry suggests this is an important but not urgent patch for organizations that know they run affected Mongoose-based products. Organizations with such products exposed to untrusted user populations should treat it with higher priority because the user-interaction requirement is often easily satisfied against personnel who routinely click links.

Detection Guidance

Detection for reflected XSS is inherently challenging because the vulnerable request is a legitimate-looking HTTP GET with encoded characters in the path. The most reliable detections combine (a) request-path heuristics for HTML metacharacters in percent-encoded form toward Mongoose-served endpoints, and (b) response-side inspection for reflected markup. Rules below are provided at the vulnerability-class level; tune thresholds and field names to the deployed log schema.

Sigma Rule

title: Potential Reflected XSS Against Cesanta Mongoose Directory Listing (CVE-2026-73259)
id: 7f3c9c1e-2b64-4a0e-9d21-8c5a1e0f4b77
status: experimental
description: Detects HTTP requests to Mongoose-served directory listing endpoints that contain percent-encoded HTML metacharacters in the request path, consistent with reflected XSS attempts targeting CVE-2026-73259.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73259
author: threat-intel
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: GET
  selection_path:
    cs-uri-stem|contains:
      - '%3C'
      - '%3E'
      - '%22'
      - '%27'
      - '%3Cscript'
      - '%3C%2Fscript'
  condition: selection_method and selection_path
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate URL-encoded content containing angle brackets in filenames or query strings
  - Automated scanners and fuzzers generating encoded payloads
level: medium
tags:
  - attack.t1190
  - cve.2026.73259

YARA Rule

rule CVE_2026_73259_Mongoose_Reflected_XSS
{
    meta:
        description = "Detects HTML responses reflecting unencoded HTML metacharacters in the title or h1 elements, consistent with reflected XSS in Cesanta Mongoose directory listing (CVE-2026-73259)"
        author = "threat-intel"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73259"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $title = "<title>" ascii nocase
        $h1_open = "<h1>" ascii nocase
        $script_tag = "<script" ascii nocase
        $onerror = "onerror=" ascii nocase
        $svg_onload = "<svg" ascii nocase
        $img_tag = "<img" ascii nocase
        $js_alert = "alert(" ascii nocase

    condition:
        ($title or $h1_open) and
        ($script_tag or $onerror or $svg_onload or $img_tag or $js_alert)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73259 Cesanta Mongoose Reflected XSS via Percent-Encoded Path"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"%3C"; nocase; http.uri; content:"%3E"; nocase; reference:cve,2026-73259; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73259; classtype:web-application-attack; sid:90073259; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and http.request.method == "GET"
    and wildcard(http.request.uri.path, "*%3C*") and wildcard(http.request.uri.path, "*%3E*")]
  [network where network.protocol == "http" and http.response.status_code == 200
    and wildcard(http.response.mime_type, "*text/html*")]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| eval uri=coalesce(uri_path, cs_uri_stem, url)
| where match(uri, "(?i)%3C|%3E|%22|%27")
| rex field=uri "(?<xss_marker>%3Cscript|%3C%2Fscript|onerror%3D|<script|onerror=)"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, xss_marker
| where count > 0
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-73259,">
  <rule id="100732" level="10">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <url>%3C|%3E|%22|%27|%3Cscript|onerror%3D</url>
    <description>CVE-2026-73259: Possible reflected XSS attempt against Cesanta Mongoose directory listing (percent-encoded HTML metacharacters in request path)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73259,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix; sources: NVD, OSV).

1. Immediate mitigations. For deployments that cannot be upgraded immediately, disable directory listing by removing or not defining the MG_ENABLE_DIRLIST compile-time option. The vulnerable code path in mg_http_serve_dir() / listdir() is only reachable when directory listing is enabled, so recompiling without it removes exposure to this CVE. Where the build cannot be changed, restrict network access to the HTTP interface so that only trusted administrative networks can reach it, and reduce the likelihood of a victim visiting attacker-supplied links by policy and by user awareness. Note that the vendor’s published workaround field is not populated in the source data; the configuration-based mitigation above is the standard response for this code path.

2. Patch / upgrade steps. Upgrade to Cesanta Mongoose 7.22 or later, which contains the fix for this issue. Because Mongoose is typically vendored into firmware as source, this means updating the vendored copy of the library, rebuilding the product firmware, and redistributing it through the normal firmware-update channel. Confirm the upgraded build no longer reflects unencoded decoded request URIs into the title and h1 elements of directory-listing responses. Validate post-upgrade by testing the same crafted percent-encoded request path against a staging device.

3. Long-term hardening. Treat reflected output encoding as a build-time control: ensure any project vendoring Mongoose has a process for tracking upstream releases and applying security fixes on a defined cadence. Adopt a software bill of materials that includes embedded libraries so that future advisories against Mongoose and similar components can be mapped to in-field devices quickly. Add regression tests that send percent-encoded HTML metacharacters to directory-listing endpoints and assert that responses are entity-encoded. Apply defense-in-depth at the origin: set restrictive Content-Security-Policy headers and mark administrative session cookies HttpOnly and SameSite to limit the value of any future script-execution foothold in the Mongoose origin. Finally, subscribe to vendor advisories and monitor the NVD entry (CVE-2026-73259) for updates, including any future CISA KEV or exploit-in-the-wild reporting.

References

• NVD — CVE-2026-73259: https://nvd.nist.gov/vuln/detail/CVE-2026-73259
• OSV entry for the Cesanta Mongoose package (second independent fix source corroborating patched status in 7.22)
• Cesanta Mongoose project and release notes — consult the project’s upstream release history for the 7.22 changelog and the fix to mg_http_serve_dir() / listdir() in src/http.c
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or confirmed exploitation in the wild were identified in the source data for this CVE. CISA KEV status: not listed. EPSS 0.00407 (32.4th percentile). PoC status is reported as Public at the advisory level; no packaged exploit code or Nuclei template was confirmed in the provided data.