{"action":"Upgrade salvo to 0.88.1 or later.","affected":[{"fixed":"0.88.1","introduced":"0"}],"component":"salvo","cve_ids":["CVE-2026-22257"],"ecosystem":"crates.io","epss":0.00334,"exploited":false,"fixed_versions":["0.88.1"],"ghsa_id":"GHSA-54m3-5fxr-2f3j","id":"tcs_01M5KESY6FRW0ABZT4QY0WMC8C","modified_at":"2026-02-03T03:15:16.125543Z","published_at":"2026-01-08T21:16:41Z","references":["https://osv.dev/vulnerability/GHSA-54m3-5fxr-2f3j","https://github.com/salvo-rs/salvo/security/advisories/GHSA-54m3-5fxr-2f3j","https://nvd.nist.gov/vuln/detail/CVE-2026-22257","https://github.com/salvo-rs/salvo","https://github.com/salvo-rs/salvo/blob/16efeba312a274739606ce76366d921768628654/crates/serve-static/src/dir.rs#L581"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-54m3-5fxr-2f3j","url":"https://osv.dev/vulnerability/GHSA-54m3-5fxr-2f3j"}],"summary":"Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names"}