directory-serve vulnerabilities

1 known vulnerability in directory-serve from Cube-root. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  directory-serve: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-72569Aug 10, 2026Cube-root

  A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.