High · published January 8, 2026
⚡ A careless file view can turn your public folder into a playground for attackers!✨ Think of it as a restaurant displaying menu items with no labels. If someone can swap out a dish name for something unappetizing, unsuspecting diners might get served something they didn’t order. That's what's happening here—unvalidated file names could lead to XSS attacks! An attacker could maliciously craft a file name that runs harmful scripts when users access the folder view. This could lead to stealing sensitive information or hijacking user sessions—absolutely devastating for both the users and your website's reputation!
Think of it as a restaurant displaying menu items with no labels. If someone can swap out a dish name for something unappetizing, unsuspecting diners might get served something they didn’t order. That's what's happening here—unvalidated file names could lead to XSS attacks! The vulnerability in Salvo's `list_html` function fails to sanitize file and folder names, allowing an XSS attack when public file access is enabled. Users might inadvertently run unsafe scripts uploaded by others, compromising their security.
An attacker could maliciously craft a file name that runs harmful scripts when users access the folder view. This could lead to stealing sensitive information or hijacking user sessions—absolutely devastating for both the users and your website's reputation! Upgrade Salvo to version 0.88.1 immediately to close this security gap. Additionally, implement stringent sanitization checks for uploaded file names and review other input handling processes to bolster overall security. You don’t want to leave a door open for attackers! You've got this! Activate your security hero status and get your site safely patched up! 🛡️