CVE-2026-72569 PUBLISHED

cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion

Assigner: TuranSec
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 10.08.2026

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	cube-root
Product	directory-serve
Versions	Default: unknown affected from 0 to 1.3.7 (incl.)

Credits

Bo'riboy Abdurahmonov finder

References

Product
Vulnerable File

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE