Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Date: 2025-10
Affected: maven/io.vertx:vertx-web, maven/io.vertx:vertx-web
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-11966
CWE: CWE-79
CVSS: 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

# Description - In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping. - As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS. - Affected Code: - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java` - Lines: - 709–713: `normalizedDir` is constructed without escaping - 714–731: `<li><a ...>` elements insert file names directly into attributes and body without escaping - 744: parent directory name construction - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping # Reproduction Steps 1. Prerequisites: - Directory listing is enabled using `StaticHandler` (e.g., `StaticHandler.create("public").setDirectoryListing(true)`) - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory) 2. Create a malicious file name (example for Unix-based OS): - Create an empty file in `public/` with one of the following names: - `<img src=x onerror=alert('XSS')>.txt` - Or attribute injection: `evil" onmouseover="alert('XSS')".txt` - Example: ```bash mkdir -p public printf '


Mitigations:

Architectural layers (MAESTRO):