CVE-2026-22257
1 advisory.
crates.io/salvo CVE-2026-22257: high 8.8, EPSS 0.33%
Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names
Action: Upgrade salvo to 0.88.1 or later.
cargo update -p salvo --precise 0.88.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.88.1 | - |
Fixed versions
| 0.88.1 |
Sources
- osv: GHSA-54m3-5fxr-2f3j
- https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j
- https://nvd.nist.gov/vuln/detail/CVE-2026-22257
- https://github.com/salvo-rs/salvo
- https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581
CVE-2026-22257 · published · modified · JSON