CVE-2026-22256
📋 TL;DR
This is a reflected cross-site scripting (XSS) vulnerability in the Salvo Rust web framework's directory listing functionality. Attackers can inject malicious scripts via URL paths that get rendered without proper sanitization in the HTML file view. Any application using Salvo's static file serving with directory listing enabled is affected.
💻 Affected Systems
- Salvo Rust web framework
📦 What is this software?
Salvo by Salvo
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as the user, or redirecting to malicious sites.
Likely Case
Session hijacking, credential theft, or defacement of the directory listing page through script injection.
If Mitigated
Limited impact if directory listing is disabled or proper input validation is implemented elsewhere.
🎯 Exploit Status
Exploitation requires crafting malicious URLs but is straightforward once the vulnerable endpoint is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.88.1
Vendor Advisory: https://github.com/salvo-rs/salvo/security/advisories/GHSA-rjf8-2wcw-f6mp
Restart Required: Yes
Instructions:
1. Update Salvo dependency to version 0.88.1 or later in Cargo.toml. 2. Run 'cargo update'. 3. Rebuild and redeploy the application.
🔧 Temporary Workarounds
Disable directory listing
allDisable the directory listing functionality in Salvo's static file serving configuration.
Modify Salvo configuration to disable directory listing for static file routes
Implement WAF rules
allAdd web application firewall rules to block malicious path patterns containing script tags or JavaScript.
🧯 If You Can't Patch
- Disable directory listing functionality entirely in Salvo configuration
- Implement reverse proxy with input sanitization for path parameters
🔍 How to Verify
Check if Vulnerable:
Check if Salvo version is below 0.88.1 and directory listing is enabled for static file routes.Check Version:
grep -A1 'salvo' Cargo.lock | grep versionVerify Fix Applied:
Verify Salvo version is 0.88.1 or higher in Cargo.lock and test directory listing endpoints with XSS payloads.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with suspicious characters in path parameters (e.g., <script>, javascript:, onerror=)
Network Indicators:
- Unusual GET requests to directory listing endpoints with encoded script payloads
SIEM Query:
http.method:GET AND http.uri:*<script>* AND http.user_agent:*Salvo*